From: Victor Julien <victor@inliniac.net>
Date: Mon, 17 Jul 2017 11:45:44 +0000 (+0200)
Subject: mingw: add SCNtohl and SCNtohs macro's
X-Git-Tag: suricata-4.1.0-beta1~400
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=11be9bd971a84d934319c50443b662d216a95a70;p=thirdparty%2Fsuricata.git

mingw: add SCNtohl and SCNtohs macro's

On MinGW the result of ntohl needs to be casted to uint32_t and
the result of ntohs to uint16_t. To avoid doing this everywhere
add SCNtohl and SCNtohs macros.
---

diff --git a/src/alert-prelude.c b/src/alert-prelude.c
index 97d70ad6d4..1f654ee7f3 100644
--- a/src/alert-prelude.c
+++ b/src/alert-prelude.c
@@ -475,16 +475,16 @@ static int PacketToDataV4(const Packet *p, const PacketAlert *pa, idmef_alert_t
     AddIntData(alert, "ip_ver", IPV4_GET_RAW_VER(p->ip4h));
     AddIntData(alert, "ip_hlen", IPV4_GET_RAW_HLEN(p->ip4h));
     AddIntData(alert, "ip_tos", IPV4_GET_RAW_IPTOS(p->ip4h));
-    AddIntData(alert, "ip_len", ntohs(IPV4_GET_RAW_IPLEN(p->ip4h)));
+    AddIntData(alert, "ip_len", SCNtohs(IPV4_GET_RAW_IPLEN(p->ip4h)));
 
-    AddIntData(alert, "ip_id", ntohs(IPV4_GET_RAW_IPID(p->ip4h)));
+    AddIntData(alert, "ip_id", SCNtohs(IPV4_GET_RAW_IPID(p->ip4h)));
 
-    AddIntData(alert, "ip_off", ntohs(IPV4_GET_RAW_IPOFFSET(p->ip4h)));
+    AddIntData(alert, "ip_off", SCNtohs(IPV4_GET_RAW_IPOFFSET(p->ip4h)));
 
     AddIntData(alert, "ip_ttl", IPV4_GET_RAW_IPTTL(p->ip4h));
     AddIntData(alert, "ip_proto", IPV4_GET_RAW_IPPROTO(p->ip4h));
 
-    AddIntData(alert, "ip_sum", ntohs(p->ip4h->ip_csum));
+    AddIntData(alert, "ip_sum", SCNtohs(p->ip4h->ip_csum));
 
     SCReturnInt(0);
 }
diff --git a/src/app-layer-dns-common.c b/src/app-layer-dns-common.c
index c9f7eb3345..27e6926679 100644
--- a/src/app-layer-dns-common.c
+++ b/src/app-layer-dns-common.c
@@ -475,7 +475,7 @@ void DNSStateFree(void *s)
  */
 int DNSValidateRequestHeader(DNSState *dns_state, const DNSHeader *dns_header)
 {
-    uint16_t flags = ntohs(dns_header->flags);
+    uint16_t flags = SCNtohs(dns_header->flags);
 
     if ((flags & 0x8000) != 0) {
         SCLogDebug("not a request 0x%04x", flags);
@@ -503,7 +503,7 @@ bad_data:
  */
 int DNSValidateResponseHeader(DNSState *dns_state, const DNSHeader *dns_header)
 {
-    uint16_t flags = ntohs(dns_header->flags);
+    uint16_t flags = SCNtohs(dns_header->flags);
 
     if ((flags & 0x8000) == 0) {
         SCLogDebug("not a response 0x%04x", flags);
@@ -794,7 +794,7 @@ const uint8_t *DNSReponseParse(DNSState *dns_state, const DNSHeader * const dns_
 {
     if (input + input_len < data + 2) {
         SCLogDebug("input buffer too small for record 'name' field, record %u, "
-                "total answer_rr %u", num, ntohs(dns_header->answer_rr));
+                "total answer_rr %u", num, SCNtohs(dns_header->answer_rr));
         goto insufficient_data;
     }
 
@@ -834,33 +834,33 @@ const uint8_t *DNSReponseParse(DNSState *dns_state, const DNSHeader * const dns_
     }
 
     const DNSAnswerHeader *head = (DNSAnswerHeader *)data;
-    const uint16_t datalen = ntohs(head->len);
+    const uint16_t datalen = SCNtohs(head->len);
 
     data += sizeof(DNSAnswerHeader);
 
-    SCLogDebug("head->len %u", ntohs(head->len));
+    SCLogDebug("head->len %u", SCNtohs(head->len));
 
-    if (input + input_len < data + ntohs(head->len)) {
-        SCLogDebug("input buffer too small for data of len %u", ntohs(head->len));
+    if (input + input_len < data + SCNtohs(head->len)) {
+        SCLogDebug("input buffer too small for data of len %u", SCNtohs(head->len));
         goto insufficient_data;
     }
 
-    SCLogDebug("TTL %u", ntohl(head->ttl));
+    SCLogDebug("TTL %u", SCNtohl(head->ttl));
 
-    switch (ntohs(head->type)) {
+    switch (SCNtohs(head->type)) {
         case DNS_RECORD_TYPE_A:
         {
             if (datalen == 0 || datalen == 4) {
-                //PrintRawDataFp(stdout, data, ntohs(head->len));
+                //PrintRawDataFp(stdout, data, SCNtohs(head->len));
                 //char a[16];
                 //PrintInet(AF_INET, (const void *)data, a, sizeof(a));
-                //SCLogInfo("A %s TTL %u", a, ntohl(head->ttl));
+                //SCLogInfo("A %s TTL %u", a, SCNtohl(head->ttl));
 
                 DNSStoreAnswerInState(dns_state, list, fqdn, fqdn_len,
-                        ntohs(head->type), ntohs(head->class), ntohl(head->ttl),
-                        data, datalen, ntohs(dns_header->tx_id));
+                        SCNtohs(head->type), SCNtohs(head->class), SCNtohl(head->ttl),
+                        data, datalen, SCNtohs(dns_header->tx_id));
             } else {
-                SCLogDebug("invalid length for A response data: %u", ntohs(head->len));
+                SCLogDebug("invalid length for A response data: %u", SCNtohs(head->len));
                 goto bad_data;
             }
 
@@ -872,13 +872,13 @@ const uint8_t *DNSReponseParse(DNSState *dns_state, const DNSHeader * const dns_
             if (datalen == 0 || datalen == 16) {
                 //char a[46];
                 //PrintInet(AF_INET6, (const void *)data, a, sizeof(a));
-                //SCLogInfo("AAAA %s TTL %u", a, ntohl(head->ttl));
+                //SCLogInfo("AAAA %s TTL %u", a, SCNtohl(head->ttl));
 
                 DNSStoreAnswerInState(dns_state, list, fqdn, fqdn_len,
-                        ntohs(head->type), ntohs(head->class), ntohl(head->ttl),
-                        data, datalen, ntohs(dns_header->tx_id));
+                        SCNtohs(head->type), SCNtohs(head->class), SCNtohl(head->ttl),
+                        data, datalen, SCNtohs(dns_header->tx_id));
             } else {
-                SCLogDebug("invalid length for AAAA response data: %u", ntohs(head->len));
+                SCLogDebug("invalid length for AAAA response data: %u", SCNtohs(head->len));
                 goto bad_data;
             }
 
@@ -893,7 +893,7 @@ const uint8_t *DNSReponseParse(DNSState *dns_state, const DNSHeader * const dns_
             uint16_t name_len = 0;
             uint8_t skip = 0;
 
-            if (ntohs(head->type) == DNS_RECORD_TYPE_MX) {
+            if (SCNtohs(head->type) == DNS_RECORD_TYPE_MX) {
                 // Skip the preference header
                 skip = 2;
             }
@@ -906,10 +906,10 @@ const uint8_t *DNSReponseParse(DNSState *dns_state, const DNSHeader * const dns_
             }
 
             DNSStoreAnswerInState(dns_state, list, fqdn, fqdn_len,
-                    ntohs(head->type), ntohs(head->class), ntohl(head->ttl),
-                    name, name_len, ntohs(dns_header->tx_id));
+                    SCNtohs(head->type), SCNtohs(head->class), SCNtohl(head->ttl),
+                    name, name_len, SCNtohs(dns_header->tx_id));
 
-            data += ntohs(head->len);
+            data += SCNtohs(head->len);
             break;
         }
         case DNS_RECORD_TYPE_NS:
@@ -925,7 +925,7 @@ const uint8_t *DNSReponseParse(DNSState *dns_state, const DNSHeader * const dns_
                 goto insufficient_data;
             }
 
-            if (ntohs(head->type) == DNS_RECORD_TYPE_SOA) {
+            if (SCNtohs(head->type) == DNS_RECORD_TYPE_SOA) {
                 const uint8_t *sdata = SkipDomain(input, input_len, data);
                 if (sdata == NULL) {
                     goto insufficient_data;
@@ -962,17 +962,17 @@ const uint8_t *DNSReponseParse(DNSState *dns_state, const DNSHeader * const dns_
                 }
 
                 SCLogDebug("serial %u refresh %u retry %u exp %u min ttl %u",
-                        ntohl(tail->serial), ntohl(tail->refresh),
-                        ntohl(tail->retry), ntohl(tail->experiation),
-                        ntohl(tail->minttl));
+                        SCNtohl(tail->serial), SCNtohl(tail->refresh),
+                        SCNtohl(tail->retry), SCNtohl(tail->experiation),
+                        SCNtohl(tail->minttl));
 #endif
             }
 
             DNSStoreAnswerInState(dns_state, list, fqdn, fqdn_len,
-                    ntohs(head->type), ntohs(head->class), ntohl(head->ttl),
-                    pname, pname_len, ntohs(dns_header->tx_id));
+                    SCNtohs(head->type), SCNtohs(head->class), SCNtohl(head->ttl),
+                    pname, pname_len, SCNtohs(dns_header->tx_id));
 
-            data += ntohs(head->len);
+            data += SCNtohs(head->len);
             break;
         }
         case DNS_RECORD_TYPE_TXT:
@@ -994,8 +994,8 @@ const uint8_t *DNSReponseParse(DNSState *dns_state, const DNSHeader * const dns_
                     goto bad_data;
 
                 DNSStoreAnswerInState(dns_state, list, fqdn, fqdn_len,
-                        ntohs(head->type), ntohs(head->class), ntohl(head->ttl),
-                        (uint8_t*)tdata, (uint16_t)txtlen, ntohs(dns_header->tx_id));
+                        SCNtohs(head->type), SCNtohs(head->class), SCNtohl(head->ttl),
+                        (uint8_t*)tdata, (uint16_t)txtlen, SCNtohs(dns_header->tx_id));
 
                 txtdatalen -= txtlen;
                 tdata += txtlen;
@@ -1019,8 +1019,8 @@ const uint8_t *DNSReponseParse(DNSState *dns_state, const DNSHeader * const dns_
              * code figure out what to do with it. */
 
             DNSStoreAnswerInState(dns_state, list, fqdn, fqdn_len,
-                    ntohs(head->type), ntohs(head->class), ntohl(head->ttl),
-                    data, ntohs(head->len), ntohs(dns_header->tx_id));
+                    SCNtohs(head->type), SCNtohs(head->class), SCNtohl(head->ttl),
+                    data, SCNtohs(head->len), SCNtohs(dns_header->tx_id));
 
             data += datalen;
             break;
@@ -1028,10 +1028,10 @@ const uint8_t *DNSReponseParse(DNSState *dns_state, const DNSHeader * const dns_
         default:    /* unsupported record */
         {
             DNSStoreAnswerInState(dns_state, list, NULL, 0,
-                    ntohs(head->type), ntohs(head->class), ntohl(head->ttl),
-                    NULL, 0, ntohs(dns_header->tx_id));
+                    SCNtohs(head->type), SCNtohs(head->class), SCNtohl(head->ttl),
+                    NULL, 0, SCNtohs(dns_header->tx_id));
 
-            //PrintRawDataFp(stdout, data, ntohs(head->len));
+            //PrintRawDataFp(stdout, data, SCNtohs(head->len));
             data += datalen;
             break;
         }
diff --git a/src/app-layer-dns-tcp.c b/src/app-layer-dns-tcp.c
index af54ce849b..b352144b19 100644
--- a/src/app-layer-dns-tcp.c
+++ b/src/app-layer-dns-tcp.c
@@ -76,10 +76,10 @@ static int DNSTCPRequestParseProbe(uint8_t *input, uint32_t input_len)
     SCLogDebug("starting %u", input_len);
 
     DNSTcpHeader *dns_tcp_header = (DNSTcpHeader *)input;
-    if (ntohs(dns_tcp_header->len) < sizeof(DNSHeader)) {
+    if (SCNtohs(dns_tcp_header->len) < sizeof(DNSHeader)) {
         goto bad_data;
     }
-    if (ntohs(dns_tcp_header->len) >= input_len) {
+    if (SCNtohs(dns_tcp_header->len) >= input_len) {
         goto insufficient_data;
     }
 
@@ -90,7 +90,7 @@ static int DNSTCPRequestParseProbe(uint8_t *input, uint32_t input_len)
     uint16_t q;
     const uint8_t *data = input + sizeof(DNSHeader);
 
-    for (q = 0; q < ntohs(dns_header->questions); q++) {
+    for (q = 0; q < SCNtohs(dns_header->questions); q++) {
         uint16_t fqdn_offset = 0;
 
         if (input + input_len < data + 1) {
@@ -143,7 +143,7 @@ static int DNSTCPRequestParseProbe(uint8_t *input, uint32_t input_len)
         }
 #ifdef DEBUG
         DNSQueryTrailer *trailer = (DNSQueryTrailer *)data;
-        SCLogDebug("trailer type %04x class %04x", ntohs(trailer->type), ntohs(trailer->class));
+        SCLogDebug("trailer type %04x class %04x", SCNtohs(trailer->type), SCNtohs(trailer->class));
 #endif
         data += sizeof(DNSQueryTrailer);
     }
@@ -196,7 +196,7 @@ static int DNSRequestParseData(Flow *f, DNSState *dns_state, const uint8_t *inpu
     if (DNSValidateRequestHeader(dns_state, dns_header) < 0)
         goto bad_data;
 
-    //SCLogInfo("ID %04x", ntohs(dns_header->tx_id));
+    //SCLogInfo("ID %04x", SCNtohs(dns_header->tx_id));
 
     uint16_t q;
     const uint8_t *data = input + sizeof(DNSHeader);
@@ -211,7 +211,7 @@ static int DNSRequestParseData(Flow *f, DNSState *dns_state, const uint8_t *inpu
         }
     }
 
-    for (q = 0; q < ntohs(dns_header->questions); q++) {
+    for (q = 0; q < SCNtohs(dns_header->questions); q++) {
         uint8_t fqdn[DNS_MAX_SIZE];
         uint16_t fqdn_offset = 0;
 
@@ -266,14 +266,14 @@ static int DNSRequestParseData(Flow *f, DNSState *dns_state, const uint8_t *inpu
             goto insufficient_data;
         }
         DNSQueryTrailer *trailer = (DNSQueryTrailer *)data;
-        SCLogDebug("trailer type %04x class %04x", ntohs(trailer->type), ntohs(trailer->class));
+        SCLogDebug("trailer type %04x class %04x", SCNtohs(trailer->type), SCNtohs(trailer->class));
         data += sizeof(DNSQueryTrailer);
 
         /* store our data */
         if (dns_state != NULL) {
             DNSStoreQueryInState(dns_state, fqdn, fqdn_offset,
-                    ntohs(trailer->type), ntohs(trailer->class),
-                    ntohs(dns_header->tx_id));
+                    SCNtohs(trailer->type), SCNtohs(trailer->class),
+                    SCNtohs(dns_header->tx_id));
         }
     }
 
@@ -341,26 +341,26 @@ next_record:
         DNSTcpHeader *dns_tcp_header = (DNSTcpHeader *)input;
         SCLogDebug("DNS %p", dns_tcp_header);
 
-        if (ntohs(dns_tcp_header->len) < sizeof(DNSHeader)) {
+        if (SCNtohs(dns_tcp_header->len) < sizeof(DNSHeader)) {
             /* bogus len, doesn't fit even basic dns header */
             goto bad_data;
-        } else if (ntohs(dns_tcp_header->len) == (input_len-2)) {
+        } else if (SCNtohs(dns_tcp_header->len) == (input_len-2)) {
             /* we have all data, so process w/o buffering */
             if (DNSRequestParseData(f, dns_state, input+2, input_len-2) < 0)
                 goto bad_data;
 
-        } else if ((input_len-2) > ntohs(dns_tcp_header->len)) {
+        } else if ((input_len-2) > SCNtohs(dns_tcp_header->len)) {
             /* we have all data, so process w/o buffering */
-            if (DNSRequestParseData(f, dns_state, input+2, ntohs(dns_tcp_header->len)) < 0)
+            if (DNSRequestParseData(f, dns_state, input+2, SCNtohs(dns_tcp_header->len)) < 0)
                 goto bad_data;
 
             /* treat the rest of the data as a (potential) new record */
-            input += (2 + ntohs(dns_tcp_header->len));
-            input_len -= (2 + ntohs(dns_tcp_header->len));
+            input += (2 + SCNtohs(dns_tcp_header->len));
+            input_len -= (2 + SCNtohs(dns_tcp_header->len));
             goto next_record;
         } else {
             /* not enough data, store record length and buffer */
-            dns_state->record_len = ntohs(dns_tcp_header->len);
+            dns_state->record_len = SCNtohs(dns_tcp_header->len);
             BufferData(dns_state, input+2, input_len-2);
         }
     } else if (input_len + dns_state->offset < dns_state->record_len) {
@@ -409,7 +409,7 @@ static int DNSReponseParseData(Flow *f, DNSState *dns_state, const uint8_t *inpu
 
     DNSTransaction *tx = NULL;
     int found = 0;
-    if ((tx = DNSTransactionFindByTxId(dns_state, ntohs(dns_header->tx_id))) != NULL)
+    if ((tx = DNSTransactionFindByTxId(dns_state, SCNtohs(dns_header->tx_id))) != NULL)
         found = 1;
 
     if (!found) {
@@ -421,7 +421,7 @@ static int DNSReponseParseData(Flow *f, DNSState *dns_state, const uint8_t *inpu
 
     uint16_t q;
     const uint8_t *data = input + sizeof(DNSHeader);
-    for (q = 0; q < ntohs(dns_header->questions); q++) {
+    for (q = 0; q < SCNtohs(dns_header->questions); q++) {
         uint8_t fqdn[DNS_MAX_SIZE];
         uint16_t fqdn_offset = 0;
 
@@ -469,12 +469,12 @@ static int DNSReponseParseData(Flow *f, DNSState *dns_state, const uint8_t *inpu
         }
 #if DEBUG
         DNSQueryTrailer *trailer = (DNSQueryTrailer *)data;
-        SCLogDebug("trailer type %04x class %04x", ntohs(trailer->type), ntohs(trailer->class));
+        SCLogDebug("trailer type %04x class %04x", SCNtohs(trailer->type), SCNtohs(trailer->class));
 #endif
         data += sizeof(DNSQueryTrailer);
     }
 
-    for (q = 0; q < ntohs(dns_header->answer_rr); q++) {
+    for (q = 0; q < SCNtohs(dns_header->answer_rr); q++) {
         data = DNSReponseParse(dns_state, dns_header, q, DNS_LIST_ANSWER,
                 input, input_len, data);
         if (data == NULL) {
@@ -483,7 +483,7 @@ static int DNSReponseParseData(Flow *f, DNSState *dns_state, const uint8_t *inpu
     }
 
     //PrintRawDataFp(stdout, (uint8_t *)data, input_len - (data - input));
-    for (q = 0; q < ntohs(dns_header->authority_rr); q++) {
+    for (q = 0; q < SCNtohs(dns_header->authority_rr); q++) {
         data = DNSReponseParse(dns_state, dns_header, q, DNS_LIST_AUTHORITY,
                 input, input_len, data);
         if (data == NULL) {
@@ -492,7 +492,7 @@ static int DNSReponseParseData(Flow *f, DNSState *dns_state, const uint8_t *inpu
     }
 
     /* parse rcode, e.g. "noerror" or "nxdomain" */
-    uint8_t rcode = ntohs(dns_header->flags) & 0x0F;
+    uint8_t rcode = SCNtohs(dns_header->flags) & 0x0F;
     if (rcode <= DNS_RCODE_NOTZONE) {
         SCLogDebug("rcode %u", rcode);
         if (tx != NULL)
@@ -502,7 +502,7 @@ static int DNSReponseParseData(Flow *f, DNSState *dns_state, const uint8_t *inpu
         SCLogDebug("unexpected DNS rcode %u", rcode);
     }
 
-    if (ntohs(dns_header->flags) & 0x0080) {
+    if (SCNtohs(dns_header->flags) & 0x0080) {
         SCLogDebug("recursion desired");
         if (tx != NULL)
             tx->recursion_desired = 1;
@@ -581,25 +581,25 @@ next_record:
         DNSTcpHeader *dns_tcp_header = (DNSTcpHeader *)input;
         SCLogDebug("DNS %p", dns_tcp_header);
 
-        if (ntohs(dns_tcp_header->len) == 0) {
+        if (SCNtohs(dns_tcp_header->len) == 0) {
             goto bad_data;
-        } else if (ntohs(dns_tcp_header->len) == (input_len-2)) {
+        } else if (SCNtohs(dns_tcp_header->len) == (input_len-2)) {
             /* we have all data, so process w/o buffering */
             if (DNSReponseParseData(f, dns_state, input+2, input_len-2) < 0)
                 goto bad_data;
 
-        } else if ((input_len-2) > ntohs(dns_tcp_header->len)) {
+        } else if ((input_len-2) > SCNtohs(dns_tcp_header->len)) {
             /* we have all data, so process w/o buffering */
-            if (DNSReponseParseData(f, dns_state, input+2, ntohs(dns_tcp_header->len)) < 0)
+            if (DNSReponseParseData(f, dns_state, input+2, SCNtohs(dns_tcp_header->len)) < 0)
                 goto bad_data;
 
             /* treat the rest of the data as a (potential) new record */
-            input += (2 + ntohs(dns_tcp_header->len));
-            input_len -= (2 + ntohs(dns_tcp_header->len));
+            input += (2 + SCNtohs(dns_tcp_header->len));
+            input_len -= (2 + SCNtohs(dns_tcp_header->len));
             goto next_record;
         } else {
             /* not enough data, store record length and buffer */
-            dns_state->record_len = ntohs(dns_tcp_header->len);
+            dns_state->record_len = SCNtohs(dns_tcp_header->len);
             BufferData(dns_state, input+2, input_len-2);
         }
     } else if (input_len + dns_state->offset < dns_state->record_len) {
@@ -648,10 +648,10 @@ static uint16_t DNSTcpProbingParser(Flow *f, uint8_t *input, uint32_t ilen,
     }
 
     DNSTcpHeader *dns_header = (DNSTcpHeader *)input;
-    if (ntohs(dns_header->len) < sizeof(DNSHeader)) {
+    if (SCNtohs(dns_header->len) < sizeof(DNSHeader)) {
         /* length field bogus, won't even fit a minimal DNS header. */
         return ALPROTO_FAILED;
-    } else if (ntohs(dns_header->len) > ilen) {
+    } else if (SCNtohs(dns_header->len) > ilen) {
         int r = DNSTCPRequestParseProbe(input, ilen);
         if (r == -1) {
             /* probing parser told us "bad data", so it's not
@@ -662,7 +662,7 @@ static uint16_t DNSTcpProbingParser(Flow *f, uint8_t *input, uint32_t ilen,
             return ALPROTO_DNS;
         }
 
-        SCLogDebug("not yet enough info %u > %u", ntohs(dns_header->len), ilen);
+        SCLogDebug("not yet enough info %u > %u", SCNtohs(dns_header->len), ilen);
         return ALPROTO_UNKNOWN;
     }
 
@@ -689,7 +689,7 @@ static uint16_t DNSTcpProbeResponse(Flow *f, uint8_t *input, uint32_t len,
 
     DNSTcpHeader *dns_header = (DNSTcpHeader *)input;
 
-    if (ntohs(dns_header->len) < sizeof(DNSHeader)) {
+    if (SCNtohs(dns_header->len) < sizeof(DNSHeader)) {
         return ALPROTO_FAILED;
     }
 
diff --git a/src/app-layer-dns-udp.c b/src/app-layer-dns-udp.c
index 6b195180ab..a31abf21cc 100644
--- a/src/app-layer-dns-udp.c
+++ b/src/app-layer-dns-udp.c
@@ -95,7 +95,7 @@ static int DNSUDPRequestParse(Flow *f, void *dstate,
 
     uint16_t q;
     const uint8_t *data = input + sizeof(DNSHeader);
-    for (q = 0; q < ntohs(dns_header->questions); q++) {
+    for (q = 0; q < SCNtohs(dns_header->questions); q++) {
         uint8_t fqdn[DNS_MAX_SIZE];
         uint16_t fqdn_offset = 0;
 
@@ -152,14 +152,14 @@ static int DNSUDPRequestParse(Flow *f, void *dstate,
             goto insufficient_data;
         }
         DNSQueryTrailer *trailer = (DNSQueryTrailer *)data;
-        SCLogDebug("trailer type %04x class %04x", ntohs(trailer->type), ntohs(trailer->class));
+        SCLogDebug("trailer type %04x class %04x", SCNtohs(trailer->type), SCNtohs(trailer->class));
         data += sizeof(DNSQueryTrailer);
 
         /* store our data */
         if (dns_state != NULL) {
             DNSStoreQueryInState(dns_state, fqdn, fqdn_offset,
-                    ntohs(trailer->type), ntohs(trailer->class),
-                    ntohs(dns_header->tx_id));
+                    SCNtohs(trailer->type), SCNtohs(trailer->class),
+                    SCNtohs(dns_header->tx_id));
         }
     }
 
@@ -202,11 +202,11 @@ static int DNSUDPResponseParse(Flow *f, void *dstate,
     }
 
     DNSHeader *dns_header = (DNSHeader *)input;
-    SCLogDebug("DNS %p %04x %04x", dns_header, ntohs(dns_header->tx_id), dns_header->flags);
+    SCLogDebug("DNS %p %04x %04x", dns_header, SCNtohs(dns_header->tx_id), dns_header->flags);
 
     DNSTransaction *tx = NULL;
     int found = 0;
-    if ((tx = DNSTransactionFindByTxId(dns_state, ntohs(dns_header->tx_id))) != NULL)
+    if ((tx = DNSTransactionFindByTxId(dns_state, SCNtohs(dns_header->tx_id))) != NULL)
         found = 1;
 
     if (!found) {
@@ -219,11 +219,11 @@ static int DNSUDPResponseParse(Flow *f, void *dstate,
     if (DNSValidateResponseHeader(dns_state, dns_header) < 0)
         goto bad_data;
 
-    SCLogDebug("queries %04x", ntohs(dns_header->questions));
+    SCLogDebug("queries %04x", SCNtohs(dns_header->questions));
 
     uint16_t q;
     const uint8_t *data = input + sizeof(DNSHeader);
-    for (q = 0; q < ntohs(dns_header->questions); q++) {
+    for (q = 0; q < SCNtohs(dns_header->questions); q++) {
         uint8_t fqdn[DNS_MAX_SIZE];
         uint16_t fqdn_offset = 0;
 
@@ -272,13 +272,13 @@ static int DNSUDPResponseParse(Flow *f, void *dstate,
         }
 #if DEBUG
         DNSQueryTrailer *trailer = (DNSQueryTrailer *)data;
-        SCLogDebug("trailer type %04x class %04x", ntohs(trailer->type), ntohs(trailer->class));
+        SCLogDebug("trailer type %04x class %04x", SCNtohs(trailer->type), SCNtohs(trailer->class));
 #endif
         data += sizeof(DNSQueryTrailer);
     }
 
-    SCLogDebug("answer_rr %04x", ntohs(dns_header->answer_rr));
-    for (q = 0; q < ntohs(dns_header->answer_rr); q++) {
+    SCLogDebug("answer_rr %04x", SCNtohs(dns_header->answer_rr));
+    for (q = 0; q < SCNtohs(dns_header->answer_rr); q++) {
         data = DNSReponseParse(dns_state, dns_header, q, DNS_LIST_ANSWER,
                 input, input_len, data);
         if (data == NULL) {
@@ -286,8 +286,8 @@ static int DNSUDPResponseParse(Flow *f, void *dstate,
         }
     }
 
-    SCLogDebug("authority_rr %04x", ntohs(dns_header->authority_rr));
-    for (q = 0; q < ntohs(dns_header->authority_rr); q++) {
+    SCLogDebug("authority_rr %04x", SCNtohs(dns_header->authority_rr));
+    for (q = 0; q < SCNtohs(dns_header->authority_rr); q++) {
         data = DNSReponseParse(dns_state, dns_header, q, DNS_LIST_AUTHORITY,
                 input, input_len, data);
         if (data == NULL) {
@@ -298,11 +298,11 @@ static int DNSUDPResponseParse(Flow *f, void *dstate,
     /* if we previously didn't have a tx, it could have been created by the
      * above code, so lets check again */
     if (tx == NULL) {
-        tx = DNSTransactionFindByTxId(dns_state, ntohs(dns_header->tx_id));
+        tx = DNSTransactionFindByTxId(dns_state, SCNtohs(dns_header->tx_id));
     }
     if (tx != NULL) {
         /* parse rcode, e.g. "noerror" or "nxdomain" */
-        uint8_t rcode = ntohs(dns_header->flags) & 0x0F;
+        uint8_t rcode = SCNtohs(dns_header->flags) & 0x0F;
         if (rcode <= DNS_RCODE_NOTZONE) {
             SCLogDebug("rcode %u", rcode);
             tx->rcode = rcode;
@@ -311,7 +311,7 @@ static int DNSUDPResponseParse(Flow *f, void *dstate,
             SCLogDebug("unexpected DNS rcode %u", rcode);
         }
 
-        if (ntohs(dns_header->flags) & 0x0080) {
+        if (SCNtohs(dns_header->flags) & 0x0080) {
             SCLogDebug("recursion desired");
             tx->recursion_desired = 1;
         }
diff --git a/src/decode-erspan.c b/src/decode-erspan.c
index f2fb0eb124..d4df646206 100644
--- a/src/decode-erspan.c
+++ b/src/decode-erspan.c
@@ -53,8 +53,8 @@ int DecodeERSPAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt,
     }
 
     const ErspanHdr *ehdr = (const ErspanHdr *)pkt;
-    uint16_t version = ntohs(ehdr->ver_vlan) >> 12;
-    uint16_t vlan_id = ntohs(ehdr->ver_vlan) & 0x0fff;
+    uint16_t version = SCNtohs(ehdr->ver_vlan) >> 12;
+    uint16_t vlan_id = SCNtohs(ehdr->ver_vlan) & 0x0fff;
 
     SCLogDebug("ERSPAN: version %u vlan %u", version, vlan_id);
 
diff --git a/src/decode-ethernet.c b/src/decode-ethernet.c
index 1c5e83e97a..6bdcff7414 100644
--- a/src/decode-ethernet.c
+++ b/src/decode-ethernet.c
@@ -52,9 +52,9 @@ int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
     if (unlikely(p->ethh == NULL))
         return TM_ECODE_FAILED;
 
-    SCLogDebug("p %p pkt %p ether type %04x", p, pkt, ntohs(p->ethh->eth_type));
+    SCLogDebug("p %p pkt %p ether type %04x", p, pkt, SCNtohs(p->ethh->eth_type));
 
-    switch (ntohs(p->ethh->eth_type)) {
+    switch (SCNtohs(p->ethh->eth_type)) {
         case ETHERNET_TYPE_IP:
             //printf("DecodeEthernet ip4\n");
             DecodeIPV4(tv, dtv, p, pkt + ETHERNET_HEADER_LEN,
@@ -95,7 +95,7 @@ int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
             break;
         default:
             SCLogDebug("p %p pkt %p ether type %04x not supported", p,
-                       pkt, ntohs(p->ethh->eth_type));
+                       pkt, SCNtohs(p->ethh->eth_type));
     }
 
     return TM_ECODE_OK;
diff --git a/src/decode-gre.c b/src/decode-gre.c
index da310bf350..7c7bc80490 100644
--- a/src/decode-gre.c
+++ b/src/decode-gre.c
@@ -115,7 +115,7 @@ int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, ui
 
                     header_len += GRE_SRE_HDR_LEN;
 
-                    if ((ntohs(gsre->af) == 0) && (gsre->sre_length == 0))
+                    if ((SCNtohs(gsre->af) == 0) && (gsre->sre_length == 0))
                         break;
 
                     header_len += gsre->sre_length;
diff --git a/src/decode-gre.h b/src/decode-gre.h
index 6f3db29daa..3596059d55 100644
--- a/src/decode-gre.h
+++ b/src/decode-gre.h
@@ -70,7 +70,7 @@ typedef struct GRESreHdr_
 #define GRE_FLAG_ISSET_RECUR(r)     (r->flags & 0x07)
 #define GRE_GET_VERSION(r)   (r->version & 0x07)
 #define GRE_GET_FLAGS(r)     (r->version & 0xF8)
-#define GRE_GET_PROTO(r)     ntohs(r->ether_type)
+#define GRE_GET_PROTO(r)     SCNtohs(r->ether_type)
 
 #define GREV1_HDR_LEN           8
 #define GREV1_ACK_LEN           4
diff --git a/src/decode-icmpv4.c b/src/decode-icmpv4.c
index 2aaca710c5..20cb6e91fe 100644
--- a/src/decode-icmpv4.c
+++ b/src/decode-icmpv4.c
@@ -80,8 +80,8 @@ static int DecodePartialIPV4(Packet* p, uint8_t* partial_packet, uint16_t len)
         case IPPROTO_TCP:
             if (len >= IPV4_HEADER_LEN + TCP_HEADER_LEN ) {
                 p->icmpv4vars.emb_tcph = (TCPHdr*)(partial_packet + IPV4_HEADER_LEN);
-                p->icmpv4vars.emb_sport = ntohs(p->icmpv4vars.emb_tcph->th_sport);
-                p->icmpv4vars.emb_dport = ntohs(p->icmpv4vars.emb_tcph->th_dport);
+                p->icmpv4vars.emb_sport = SCNtohs(p->icmpv4vars.emb_tcph->th_sport);
+                p->icmpv4vars.emb_dport = SCNtohs(p->icmpv4vars.emb_tcph->th_dport);
                 p->icmpv4vars.emb_ip4_proto = IPPROTO_TCP;
 
                 SCLogDebug("DecodePartialIPV4: ICMPV4->IPV4->TCP header sport: "
@@ -92,8 +92,8 @@ static int DecodePartialIPV4(Packet* p, uint8_t* partial_packet, uint16_t len)
                 TCPHdr *emb_tcph = (TCPHdr*)(partial_packet + IPV4_HEADER_LEN);
 
                 p->icmpv4vars.emb_tcph = NULL;
-                p->icmpv4vars.emb_sport = ntohs(emb_tcph->th_sport);
-                p->icmpv4vars.emb_dport = ntohs(emb_tcph->th_dport);
+                p->icmpv4vars.emb_sport = SCNtohs(emb_tcph->th_sport);
+                p->icmpv4vars.emb_dport = SCNtohs(emb_tcph->th_dport);
                 p->icmpv4vars.emb_ip4_proto = IPPROTO_TCP;
                 SCLogDebug("DecodePartialIPV4: ICMPV4->IPV4->TCP partial header sport: "
                            "%"PRIu8" dport %"PRIu8"", p->icmpv4vars.emb_sport,
@@ -109,8 +109,8 @@ static int DecodePartialIPV4(Packet* p, uint8_t* partial_packet, uint16_t len)
         case IPPROTO_UDP:
             if (len >= IPV4_HEADER_LEN + UDP_HEADER_LEN ) {
                 p->icmpv4vars.emb_udph = (UDPHdr*)(partial_packet + IPV4_HEADER_LEN);
-                p->icmpv4vars.emb_sport = ntohs(p->icmpv4vars.emb_udph->uh_sport);
-                p->icmpv4vars.emb_dport = ntohs(p->icmpv4vars.emb_udph->uh_dport);
+                p->icmpv4vars.emb_sport = SCNtohs(p->icmpv4vars.emb_udph->uh_sport);
+                p->icmpv4vars.emb_dport = SCNtohs(p->icmpv4vars.emb_udph->uh_dport);
                 p->icmpv4vars.emb_ip4_proto = IPPROTO_UDP;
 
                 SCLogDebug("DecodePartialIPV4: ICMPV4->IPV4->UDP header sport: "
diff --git a/src/decode-icmpv4.h b/src/decode-icmpv4.h
index d3ade18fac..b0f69dd5d9 100644
--- a/src/decode-icmpv4.h
+++ b/src/decode-icmpv4.h
@@ -210,7 +210,7 @@ typedef struct ICMPV4Vars_
 /** macro for icmpv4 "code" access */
 #define ICMPV4_GET_CODE(p)      (p)->icmpv4h->code
 /** macro for icmpv4 "csum" access */
-#define ICMPV4_GET_RAW_CSUM(p)  ntohs((p)->icmpv4h->checksum)
+#define ICMPV4_GET_RAW_CSUM(p)  SCNtohs((p)->icmpv4h->checksum)
 #define ICMPV4_GET_CSUM(p)      (p)->icmpv4h->checksum
 
 /* If message is informational */
diff --git a/src/decode-icmpv6.c b/src/decode-icmpv6.c
index 18509db385..24617d356b 100644
--- a/src/decode-icmpv6.c
+++ b/src/decode-icmpv6.c
@@ -814,10 +814,10 @@ static int ICMPV6EchoReqTest01(void)
     SCLogDebug("ID: %u seq: %u", ICMPV6_GET_ID(p), ICMPV6_GET_SEQ(p));
 
     if (ICMPV6_GET_TYPE(p) != 128 || ICMPV6_GET_CODE(p) != 0 ||
-        ntohs(ICMPV6_GET_ID(p)) != 9712 || ntohs(ICMPV6_GET_SEQ(p)) != 29987) {
+        SCNtohs(ICMPV6_GET_ID(p)) != 9712 || SCNtohs(ICMPV6_GET_SEQ(p)) != 29987) {
         printf("ICMPv6 Echo reply decode failed TYPE %u CODE %u ID %04x(%u) SEQ %04x(%u): ",
-                ICMPV6_GET_TYPE(p), ICMPV6_GET_CODE(p), ICMPV6_GET_ID(p), ntohs(ICMPV6_GET_ID(p)),
-                ICMPV6_GET_SEQ(p), ntohs(ICMPV6_GET_SEQ(p)));
+                ICMPV6_GET_TYPE(p), ICMPV6_GET_CODE(p), ICMPV6_GET_ID(p), SCNtohs(ICMPV6_GET_ID(p)),
+                ICMPV6_GET_SEQ(p), SCNtohs(ICMPV6_GET_SEQ(p)));
         FAIL;
     }
 
@@ -861,10 +861,10 @@ static int ICMPV6EchoRepTest01(void)
                ICMPV6_GET_CODE(p),ICMPV6_GET_ID(p), ICMPV6_GET_SEQ(p));
 
     if (ICMPV6_GET_TYPE(p) != 129 || ICMPV6_GET_CODE(p) != 0 ||
-        ntohs(ICMPV6_GET_ID(p)) != 9712 || ntohs(ICMPV6_GET_SEQ(p)) != 29987) {
+        SCNtohs(ICMPV6_GET_ID(p)) != 9712 || SCNtohs(ICMPV6_GET_SEQ(p)) != 29987) {
         printf("ICMPv6 Echo reply decode failed TYPE %u CODE %u ID %04x(%u) SEQ %04x(%u): ",
-                ICMPV6_GET_TYPE(p), ICMPV6_GET_CODE(p), ICMPV6_GET_ID(p), ntohs(ICMPV6_GET_ID(p)),
-                ICMPV6_GET_SEQ(p), ntohs(ICMPV6_GET_SEQ(p)));
+                ICMPV6_GET_TYPE(p), ICMPV6_GET_CODE(p), ICMPV6_GET_ID(p), SCNtohs(ICMPV6_GET_ID(p)),
+                ICMPV6_GET_SEQ(p), SCNtohs(ICMPV6_GET_SEQ(p)));
         FAIL;
     }
 
diff --git a/src/decode-icmpv6.h b/src/decode-icmpv6.h
index eb0b0fd691..105d0ffb4b 100644
--- a/src/decode-icmpv6.h
+++ b/src/decode-icmpv6.h
@@ -103,7 +103,7 @@
 /** macro for icmpv6 "code" access */
 #define ICMPV6_GET_CODE(p)      (p)->icmpv6h->code
 /** macro for icmpv6 "csum" access */
-#define ICMPV6_GET_RAW_CSUM(p)      ntohs((p)->icmpv6h->csum)
+#define ICMPV6_GET_RAW_CSUM(p)      SCNtohs((p)->icmpv6h->csum)
 #define ICMPV6_GET_CSUM(p)      (p)->icmpv6h->csum
 
 /** If message is informational */
diff --git a/src/decode-ipv4.c b/src/decode-ipv4.c
index 38e7525d17..6b754ac23a 100644
--- a/src/decode-ipv4.c
+++ b/src/decode-ipv4.c
@@ -606,7 +606,7 @@ int DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, u
             }
         case IPPROTO_IP:
             /* check PPP VJ uncompressed packets and decode tcp dummy */
-            if(p->ppph != NULL && ntohs(p->ppph->protocol) == PPP_VJ_UCOMP)    {
+            if(p->ppph != NULL && SCNtohs(p->ppph->protocol) == PPP_VJ_UCOMP)    {
                 DecodeTCP(tv, dtv, p, pkt + IPV4_GET_HLEN(p),
                           IPV4_GET_IPLEN(p) -  IPV4_GET_HLEN(p), pq);
             }
diff --git a/src/decode-ipv4.h b/src/decode-ipv4.h
index c8f268d054..cddedb0ab3 100644
--- a/src/decode-ipv4.h
+++ b/src/decode-ipv4.h
@@ -125,22 +125,22 @@ typedef struct IPV4Hdr_
 #define IPV4_GET_IPTOS(p) \
     IPV4_GET_RAW_IPTOS((p)->ip4h)
 #define IPV4_GET_IPLEN(p) \
-    (ntohs(IPV4_GET_RAW_IPLEN((p)->ip4h)))
+    (SCNtohs(IPV4_GET_RAW_IPLEN((p)->ip4h)))
 #define IPV4_GET_IPID(p) \
-    (ntohs(IPV4_GET_RAW_IPID((p)->ip4h)))
+    (SCNtohs(IPV4_GET_RAW_IPID((p)->ip4h)))
 /* _IPV4_GET_IPOFFSET: get the content of the offset header field in host order */
 #define _IPV4_GET_IPOFFSET(p) \
-    (ntohs(IPV4_GET_RAW_IPOFFSET((p)->ip4h)))
+    (SCNtohs(IPV4_GET_RAW_IPOFFSET((p)->ip4h)))
 /* IPV4_GET_IPOFFSET: get the final offset */
 #define IPV4_GET_IPOFFSET(p) \
     (_IPV4_GET_IPOFFSET(p) & 0x1fff)
-/* IPV4_GET_RF: get the RF flag. Use _IPV4_GET_IPOFFSET to save a ntohs call. */
+/* IPV4_GET_RF: get the RF flag. Use _IPV4_GET_IPOFFSET to save a SCNtohs call. */
 #define IPV4_GET_RF(p) \
     (uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x8000) >> 15)
-/* IPV4_GET_DF: get the DF flag. Use _IPV4_GET_IPOFFSET to save a ntohs call. */
+/* IPV4_GET_DF: get the DF flag. Use _IPV4_GET_IPOFFSET to save a SCNtohs call. */
 #define IPV4_GET_DF(p) \
     (uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x4000) >> 14)
-/* IPV4_GET_MF: get the MF flag. Use _IPV4_GET_IPOFFSET to save a ntohs call. */
+/* IPV4_GET_MF: get the MF flag. Use _IPV4_GET_IPOFFSET to save a SCNtohs call. */
 #define IPV4_GET_MF(p) \
     (uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x2000) >> 13)
 #define IPV4_GET_IPTTL(p) \
diff --git a/src/decode-ipv6.c b/src/decode-ipv6.c
index ac0ad752ba..a54e71b24d 100644
--- a/src/decode-ipv6.c
+++ b/src/decode-ipv6.c
@@ -117,7 +117,7 @@ void DecodeIPV6FragHeader(Packet *p, uint8_t *pkt,
 
     uint32_t fh_id;
     memcpy(&fh_id, pkt+4, 4);
-    p->ip6eh.fh_id = ntohl(fh_id);
+    p->ip6eh.fh_id = SCNtohl(fh_id);
 
     SCLogDebug("IPV6 FH: offset %u, mf %s, nh %u, id %u/%x",
             p->ip6eh.fh_offset,
@@ -344,7 +344,7 @@ DecodeIPV6ExtHdrs(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt
                         }
 
                         memcpy(&ra->ip6ra_value, (ptr + 2), sizeof(ra->ip6ra_value));
-                        ra->ip6ra_value = ntohs(ra->ip6ra_value);
+                        ra->ip6ra_value = SCNtohs(ra->ip6ra_value);
                         //printf("RA option: type %" PRIu32 " len %" PRIu32 " value %" PRIu32 "\n",
                         //    ra->ip6ra_type, ra->ip6ra_len, ra->ip6ra_value);
                         other_cnt++;
@@ -360,7 +360,7 @@ DecodeIPV6ExtHdrs(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt
                         }
 
                         memcpy(&jumbo->ip6j_payload_len, (ptr+2), sizeof(jumbo->ip6j_payload_len));
-                        jumbo->ip6j_payload_len = ntohl(jumbo->ip6j_payload_len);
+                        jumbo->ip6j_payload_len = SCNtohl(jumbo->ip6j_payload_len);
                         //printf("Jumbo option: type %" PRIu32 " len %" PRIu32 " payload len %" PRIu32 "\n",
                         //    jumbo->ip6j_type, jumbo->ip6j_len, jumbo->ip6j_payload_len);
                     }
diff --git a/src/decode-ipv6.h b/src/decode-ipv6.h
index c30580cbf4..87c474be15 100644
--- a/src/decode-ipv6.h
+++ b/src/decode-ipv6.h
@@ -60,10 +60,10 @@ typedef struct IPV6Hdr_
 #define s_ip6_hlim                      ip6_hdrun.ip6_un1.ip6_un1_hlim
 
 #define IPV6_GET_RAW_VER(ip6h)          (((ip6h)->s_ip6_vfc & 0xf0) >> 4)
-#define IPV6_GET_RAW_CLASS(ip6h)        ((ntohl((ip6h)->s_ip6_flow) & 0x0FF00000) >> 20)
-#define IPV6_GET_RAW_FLOW(ip6h)         (ntohl((ip6h)->s_ip6_flow) & 0x000FFFFF)
+#define IPV6_GET_RAW_CLASS(ip6h)        ((SCNtohl((ip6h)->s_ip6_flow) & 0x0FF00000) >> 20)
+#define IPV6_GET_RAW_FLOW(ip6h)         (SCNtohl((ip6h)->s_ip6_flow) & 0x000FFFFF)
 #define IPV6_GET_RAW_NH(ip6h)           ((ip6h)->s_ip6_nxt)
-#define IPV6_GET_RAW_PLEN(ip6h)         (ntohs((ip6h)->s_ip6_plen))
+#define IPV6_GET_RAW_PLEN(ip6h)         (SCNtohs((ip6h)->s_ip6_plen))
 #define IPV6_GET_RAW_HLIM(ip6h)         ((ip6h)->s_ip6_hlim)
 
 #define IPV6_SET_RAW_VER(ip6h, value)   ((ip6h)->s_ip6_vfc = (((ip6h)->s_ip6_vfc & 0x0f) | (value << 4)))
diff --git a/src/decode-mpls.c b/src/decode-mpls.c
index 815592e1ff..9694a341f4 100644
--- a/src/decode-mpls.c
+++ b/src/decode-mpls.c
@@ -36,8 +36,8 @@
 #define MPLS_LABEL_IPV6         2
 #define MPLS_LABEL_NULL         3
 
-#define MPLS_LABEL(shim)        ntohl(shim) >> 12
-#define MPLS_BOTTOM(shim)       ((ntohl(shim) >> 8) & 0x1)
+#define MPLS_LABEL(shim)        SCNtohl(shim) >> 12
+#define MPLS_BOTTOM(shim)       ((SCNtohl(shim) >> 8) & 0x1)
 
 /* Inner protocol guessing values. */
 #define MPLS_PROTO_ETHERNET_PW  0
diff --git a/src/decode-ppp.c b/src/decode-ppp.c
index 6fff62cd17..d5aae6bb78 100644
--- a/src/decode-ppp.c
+++ b/src/decode-ppp.c
@@ -54,9 +54,9 @@ int DecodePPP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, ui
         return TM_ECODE_FAILED;
 
     SCLogDebug("p %p pkt %p PPP protocol %04x Len: %" PRId32 "",
-        p, pkt, ntohs(p->ppph->protocol), len);
+        p, pkt, SCNtohs(p->ppph->protocol), len);
 
-    switch (ntohs(p->ppph->protocol))
+    switch (SCNtohs(p->ppph->protocol))
     {
         case PPP_VJ_UCOMP:
             if (unlikely(len < (PPP_HEADER_LEN + IPV4_HEADER_LEN))) {
@@ -122,7 +122,7 @@ int DecodePPP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, ui
             return TM_ECODE_OK;
 
         default:
-            SCLogDebug("unknown PPP protocol: %" PRIx32 "",ntohs(p->ppph->protocol));
+            SCLogDebug("unknown PPP protocol: %" PRIx32 "",SCNtohs(p->ppph->protocol));
             ENGINE_SET_INVALID_EVENT(p, PPP_WRONG_TYPE);
             return TM_ECODE_OK;
     }
diff --git a/src/decode-pppoe.c b/src/decode-pppoe.c
index ae2e8127b7..7d5aeb1949 100644
--- a/src/decode-pppoe.c
+++ b/src/decode-pppoe.c
@@ -84,7 +84,7 @@ int DecodePPPOEDiscovery(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8
     uint16_t tag_length = 0;
     PPPOEDiscoveryTag* pppoedt = (PPPOEDiscoveryTag*) (p->pppoedh +  PPPOE_DISCOVERY_HEADER_MIN_LEN);
 
-    uint16_t pppoe_length = ntohs(p->pppoedh->pppoe_length);
+    uint16_t pppoe_length = SCNtohs(p->pppoedh->pppoe_length);
     uint16_t packet_length = len - PPPOE_DISCOVERY_HEADER_MIN_LEN ;
 
     SCLogDebug("pppoe_length %"PRIu16", packet_length %"PRIu16"",
@@ -99,9 +99,9 @@ int DecodePPPOEDiscovery(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8
     while (pppoedt < (PPPOEDiscoveryTag*) (pkt + (len - sizeof(PPPOEDiscoveryTag))) && pppoe_length >=4 && packet_length >=4)
     {
 #ifdef DEBUG
-        uint16_t tag_type = ntohs(pppoedt->pppoe_tag_type);
+        uint16_t tag_type = SCNtohs(pppoedt->pppoe_tag_type);
 #endif
-        tag_length = ntohs(pppoedt->pppoe_tag_length);
+        tag_length = SCNtohs(pppoedt->pppoe_tag_length);
 
         SCLogDebug ("PPPoE Tag type %x, length %u", tag_type, tag_length);
 
@@ -140,14 +140,14 @@ int DecodePPPOESession(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t
         return TM_ECODE_FAILED;
 
     SCLogDebug("PPPOE VERSION %" PRIu32 " TYPE %" PRIu32 " CODE %" PRIu32 " SESSIONID %" PRIu32 " LENGTH %" PRIu32 "",
-           PPPOE_SESSION_GET_VERSION(p->pppoesh),  PPPOE_SESSION_GET_TYPE(p->pppoesh),  p->pppoesh->pppoe_code,  ntohs(p->pppoesh->session_id),  ntohs(p->pppoesh->pppoe_length));
+           PPPOE_SESSION_GET_VERSION(p->pppoesh),  PPPOE_SESSION_GET_TYPE(p->pppoesh),  p->pppoesh->pppoe_code,  SCNtohs(p->pppoesh->session_id),  SCNtohs(p->pppoesh->pppoe_length));
 
     /* can't use DecodePPP() here because we only get a single 2-byte word to indicate protocol instead of the full PPP header */
 
-    if (ntohs(p->pppoesh->pppoe_length) > 0) {
+    if (SCNtohs(p->pppoesh->pppoe_length) > 0) {
         /* decode contained PPP packet */
 
-        switch (ntohs(p->pppoesh->protocol))
+        switch (SCNtohs(p->pppoesh->protocol))
         {
             case PPP_VJ_COMP:
             case PPP_IPX:
@@ -212,7 +212,7 @@ int DecodePPPOESession(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t
                 break;
 
             default:
-                SCLogDebug("unknown PPP protocol: %" PRIx32 "",ntohs(p->ppph->protocol));
+                SCLogDebug("unknown PPP protocol: %" PRIx32 "",SCNtohs(p->ppph->protocol));
                 ENGINE_SET_INVALID_EVENT(p, PPP_WRONG_TYPE);
                 return TM_ECODE_OK;
         }
diff --git a/src/decode-sctp.h b/src/decode-sctp.h
index 184a172e60..53aa007dbb 100644
--- a/src/decode-sctp.h
+++ b/src/decode-sctp.h
@@ -27,9 +27,9 @@
 /** size of the packet header without any chunk headers */
 #define SCTP_HEADER_LEN                       12
 
-/* XXX RAW* needs to be really 'raw', so no ntohs there */
-#define SCTP_GET_RAW_SRC_PORT(sctph)          ntohs((sctph)->sh_sport)
-#define SCTP_GET_RAW_DST_PORT(sctph)          ntohs((sctph)->sh_dport)
+/* XXX RAW* needs to be really 'raw', so no SCNtohs there */
+#define SCTP_GET_RAW_SRC_PORT(sctph)          SCNtohs((sctph)->sh_sport)
+#define SCTP_GET_RAW_DST_PORT(sctph)          SCNtohs((sctph)->sh_dport)
 
 #define SCTP_GET_SRC_PORT(p)                  SCTP_GET_RAW_SRC_PORT(p->sctph)
 #define SCTP_GET_DST_PORT(p)                  SCTP_GET_RAW_DST_PORT(p->sctph)
diff --git a/src/decode-sll.c b/src/decode-sll.c
index eed61a4c39..d9730de2d2 100644
--- a/src/decode-sll.c
+++ b/src/decode-sll.c
@@ -49,9 +49,9 @@ int DecodeSll(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, ui
     if (unlikely(sllh == NULL))
         return TM_ECODE_FAILED;
 
-    SCLogDebug("p %p pkt %p sll_protocol %04x", p, pkt, ntohs(sllh->sll_protocol));
+    SCLogDebug("p %p pkt %p sll_protocol %04x", p, pkt, SCNtohs(sllh->sll_protocol));
 
-    switch (ntohs(sllh->sll_protocol)) {
+    switch (SCNtohs(sllh->sll_protocol)) {
         case ETHERNET_TYPE_IP:
             DecodeIPV4(tv, dtv, p, pkt + SLL_HEADER_LEN,
                        len - SLL_HEADER_LEN, pq);
@@ -66,7 +66,7 @@ int DecodeSll(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, ui
             break;
         default:
             SCLogDebug("p %p pkt %p sll type %04x not supported", p,
-                       pkt, ntohs(sllh->sll_protocol));
+                       pkt, SCNtohs(sllh->sll_protocol));
     }
 
     return TM_ECODE_OK;
diff --git a/src/decode-tcp.c b/src/decode-tcp.c
index 1ff16e0a7f..bc02e2b52d 100644
--- a/src/decode-tcp.c
+++ b/src/decode-tcp.c
@@ -129,8 +129,8 @@ static int DecodeTCPOptions(Packet *p, uint8_t *pkt, uint16_t len)
                         } else {
                             uint32_t values[2];
                             memcpy(&values, tcp_opts[tcp_opt_cnt].data, sizeof(values));
-                            p->tcpvars.ts_val = ntohl(values[0]);
-                            p->tcpvars.ts_ecr = ntohl(values[1]);
+                            p->tcpvars.ts_val = SCNtohl(values[0]);
+                            p->tcpvars.ts_ecr = SCNtohl(values[1]);
                             p->tcpvars.ts_set = TRUE;
                         }
                     }
diff --git a/src/decode-tcp.h b/src/decode-tcp.h
index 0621d7ef61..fca7e4c3fe 100644
--- a/src/decode-tcp.h
+++ b/src/decode-tcp.h
@@ -64,18 +64,18 @@
 
 #define TCP_GET_RAW_OFFSET(tcph)             (((tcph)->th_offx2 & 0xf0) >> 4)
 #define TCP_GET_RAW_X2(tcph)                 (unsigned char)((tcph)->th_offx2 & 0x0f)
-#define TCP_GET_RAW_SRC_PORT(tcph)           ntohs((tcph)->th_sport)
-#define TCP_GET_RAW_DST_PORT(tcph)           ntohs((tcph)->th_dport)
+#define TCP_GET_RAW_SRC_PORT(tcph)           SCNtohs((tcph)->th_sport)
+#define TCP_GET_RAW_DST_PORT(tcph)           SCNtohs((tcph)->th_dport)
 
 #define TCP_SET_RAW_TCP_OFFSET(tcph, value)  ((tcph)->th_offx2 = (unsigned char)(((tcph)->th_offx2 & 0x0f) | (value << 4)))
 #define TCP_SET_RAW_TCP_X2(tcph, value)      ((tcph)->th_offx2 = (unsigned char)(((tcph)->th_offx2 & 0xf0) | (value & 0x0f)))
 
-#define TCP_GET_RAW_SEQ(tcph)                ntohl((tcph)->th_seq)
-#define TCP_GET_RAW_ACK(tcph)                ntohl((tcph)->th_ack)
+#define TCP_GET_RAW_SEQ(tcph)                SCNtohl((tcph)->th_seq)
+#define TCP_GET_RAW_ACK(tcph)                SCNtohl((tcph)->th_ack)
 
-#define TCP_GET_RAW_WINDOW(tcph)             ntohs((tcph)->th_win)
-#define TCP_GET_RAW_URG_POINTER(tcph)        ntohs((tcph)->th_urp)
-#define TCP_GET_RAW_SUM(tcph)                ntohs((tcph)->th_sum)
+#define TCP_GET_RAW_WINDOW(tcph)             SCNtohs((tcph)->th_win)
+#define TCP_GET_RAW_URG_POINTER(tcph)        SCNtohs((tcph)->th_urp)
+#define TCP_GET_RAW_SUM(tcph)                SCNtohs((tcph)->th_sum)
 
 /** macro for getting the first timestamp from the packet in host order */
 #define TCP_GET_TSVAL(p)                    ((p)->tcpvars.ts_val)
diff --git a/src/decode-udp.h b/src/decode-udp.h
index cfbdc7f23a..a033e086e1 100644
--- a/src/decode-udp.h
+++ b/src/decode-udp.h
@@ -26,11 +26,11 @@
 
 #define UDP_HEADER_LEN         8
 
-/* XXX RAW* needs to be really 'raw', so no ntohs there */
-#define UDP_GET_RAW_LEN(udph)                ntohs((udph)->uh_len)
-#define UDP_GET_RAW_SRC_PORT(udph)           ntohs((udph)->uh_sport)
-#define UDP_GET_RAW_DST_PORT(udph)           ntohs((udph)->uh_dport)
-#define UDP_GET_RAW_SUM(udph)                ntohs((udph)->uh_sum)
+/* XXX RAW* needs to be really 'raw', so no SCNtohs there */
+#define UDP_GET_RAW_LEN(udph)                SCNtohs((udph)->uh_len)
+#define UDP_GET_RAW_SRC_PORT(udph)           SCNtohs((udph)->uh_sport)
+#define UDP_GET_RAW_DST_PORT(udph)           SCNtohs((udph)->uh_dport)
+#define UDP_GET_RAW_SUM(udph)                SCNtohs((udph)->uh_sum)
 
 #define UDP_GET_LEN(p)                       UDP_GET_RAW_LEN(p->udph)
 #define UDP_GET_SRC_PORT(p)                  UDP_GET_RAW_SRC_PORT(p->udph)
diff --git a/src/decode-vlan.c b/src/decode-vlan.c
index 6db2aaaf16..e9478da255 100644
--- a/src/decode-vlan.c
+++ b/src/decode-vlan.c
@@ -167,7 +167,7 @@ static int DecodeIEEE8021ah(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, ui
     }
 
     IEEE8021ahHdr *hdr = (IEEE8021ahHdr *)pkt;
-    uint16_t next_proto = ntohs(hdr->type);
+    uint16_t next_proto = SCNtohs(hdr->type);
 
     switch (next_proto) {
         case ETHERNET_TYPE_VLAN:
diff --git a/src/decode-vlan.h b/src/decode-vlan.h
index baa364726f..bdc0c0cc1c 100644
--- a/src/decode-vlan.h
+++ b/src/decode-vlan.h
@@ -31,10 +31,10 @@ uint16_t DecodeVLANGetId(const struct Packet_ *, uint8_t layer);
 #define ETHERNET_TYPE_VLAN          0x8100
 
 /** Vlan macros to access Vlan priority, Vlan CFI and VID */
-#define GET_VLAN_PRIORITY(vlanh)    ((ntohs((vlanh)->vlan_cfi) & 0xe000) >> 13)
-#define GET_VLAN_CFI(vlanh)         ((ntohs((vlanh)->vlan_cfi) & 0x0100) >> 12)
-#define GET_VLAN_ID(vlanh)          ((uint16_t)(ntohs((vlanh)->vlan_cfi) & 0x0FFF))
-#define GET_VLAN_PROTO(vlanh)       ((ntohs((vlanh)->protocol)))
+#define GET_VLAN_PRIORITY(vlanh)    ((SCNtohs((vlanh)->vlan_cfi) & 0xe000) >> 13)
+#define GET_VLAN_CFI(vlanh)         ((SCNtohs((vlanh)->vlan_cfi) & 0x0100) >> 12)
+#define GET_VLAN_ID(vlanh)          ((uint16_t)(SCNtohs((vlanh)->vlan_cfi) & 0x0FFF))
+#define GET_VLAN_PROTO(vlanh)       ((SCNtohs((vlanh)->protocol)))
 
 /* return vlan id in host byte order */
 #define VLAN_GET_ID1(p)             DecodeVLANGetId((p), 0)
diff --git a/src/defrag-hash.c b/src/defrag-hash.c
index 2d793e1346..ebf867902a 100644
--- a/src/defrag-hash.c
+++ b/src/defrag-hash.c
@@ -336,7 +336,7 @@ void DefragHashShutdown(void)
  *
  *  \note we don't care about the real ipv6 ip's, this is just
  *        to consistently fill the DefragHashKey6 struct, without all
- *        the ntohl calls.
+ *        the SCNtohl calls.
  *
  *  \warning do not use elsewhere unless you know what you're doing.
  *           detect-engine-address-ipv6.c's AddressIPv6GtU32 is likely
diff --git a/src/detect-csum.c b/src/detect-csum.c
index cf2027b2a6..89341b533b 100644
--- a/src/detect-csum.c
+++ b/src/detect-csum.c
@@ -726,7 +726,7 @@ static int DetectICMPV4CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
 
     if (p->level4_comp_csum == -1)
         p->level4_comp_csum = ICMPV4CalculateChecksum((uint16_t *)p->icmpv4h,
-                                                      ntohs(IPV4_GET_RAW_IPLEN(p->ip4h)) -
+                                                      SCNtohs(IPV4_GET_RAW_IPLEN(p->ip4h)) -
                                                       IPV4_GET_RAW_HLEN(p->ip4h) * 4);
 
     if (p->level4_comp_csum == p->icmpv4h->checksum && cd->valid == 1)
diff --git a/src/detect-engine-address-ipv4.c b/src/detect-engine-address-ipv4.c
index 93f745bbf6..e5c3dcf21f 100644
--- a/src/detect-engine-address-ipv4.c
+++ b/src/detect-engine-address-ipv4.c
@@ -58,10 +58,10 @@
  */
 int DetectAddressCmpIPv4(DetectAddress *a, DetectAddress *b)
 {
-    uint32_t a_ip1 = ntohl(a->ip.addr_data32[0]);
-    uint32_t a_ip2 = ntohl(a->ip2.addr_data32[0]);
-    uint32_t b_ip1 = ntohl(b->ip.addr_data32[0]);
-    uint32_t b_ip2 = ntohl(b->ip2.addr_data32[0]);
+    uint32_t a_ip1 = SCNtohl(a->ip.addr_data32[0]);
+    uint32_t a_ip2 = SCNtohl(a->ip2.addr_data32[0]);
+    uint32_t b_ip1 = SCNtohl(b->ip.addr_data32[0]);
+    uint32_t b_ip2 = SCNtohl(b->ip2.addr_data32[0]);
 
     if (a_ip1 == b_ip1 && a_ip2 == b_ip2) {
         SCLogDebug("ADDRESS_EQ");
@@ -113,10 +113,10 @@ int DetectAddressCmpIPv4(DetectAddress *a, DetectAddress *b)
 int DetectAddressCutIPv4(DetectEngineCtx *de_ctx, DetectAddress *a,
                          DetectAddress *b, DetectAddress **c)
 {
-    uint32_t a_ip1 = ntohl(a->ip.addr_data32[0]);
-    uint32_t a_ip2 = ntohl(a->ip2.addr_data32[0]);
-    uint32_t b_ip1 = ntohl(b->ip.addr_data32[0]);
-    uint32_t b_ip2 = ntohl(b->ip2.addr_data32[0]);
+    uint32_t a_ip1 = SCNtohl(a->ip.addr_data32[0]);
+    uint32_t a_ip2 = SCNtohl(a->ip2.addr_data32[0]);
+    uint32_t b_ip1 = SCNtohl(b->ip.addr_data32[0]);
+    uint32_t b_ip2 = SCNtohl(b->ip2.addr_data32[0]);
     DetectAddress *tmp = NULL;
     DetectAddress *tmp_c = NULL;
     int r = 0;
@@ -319,15 +319,15 @@ int DetectAddressIsCompleteIPSpaceIPv4(DetectAddress *ag)
         return 0;
 
     /* if we don't start with 0.0.0.0 we know we're good */
-    if (ntohl(ag->ip.addr_data32[0]) != 0x00000000)
+    if (SCNtohl(ag->ip.addr_data32[0]) != 0x00000000)
         return 0;
 
     /* if we're ending with 255.255.255.255 while we know we started with
      * 0.0.0.0 it's the complete space */
-    if (ntohl(ag->ip2.addr_data32[0]) == 0xFFFFFFFF)
+    if (SCNtohl(ag->ip2.addr_data32[0]) == 0xFFFFFFFF)
         return 1;
 
-    next_ip = htonl(ntohl(ag->ip2.addr_data32[0]) + 1);
+    next_ip = htonl(SCNtohl(ag->ip2.addr_data32[0]) + 1);
     ag = ag->next;
 
     for ( ; ag != NULL; ag = ag->next) {
@@ -335,10 +335,10 @@ int DetectAddressIsCompleteIPSpaceIPv4(DetectAddress *ag)
         if (ag->ip.addr_data32[0] != next_ip)
             return 0;
 
-        if (ntohl(ag->ip2.addr_data32[0]) == 0xFFFFFFFF)
+        if (SCNtohl(ag->ip2.addr_data32[0]) == 0xFFFFFFFF)
             return 1;
 
-        next_ip = htonl(ntohl(ag->ip2.addr_data32[0]) + 1);
+        next_ip = htonl(SCNtohl(ag->ip2.addr_data32[0]) + 1);
     }
 
     return 0;
@@ -367,8 +367,8 @@ int DetectAddressIsCompleteIPSpaceIPv4(DetectAddress *ag)
  */
 int DetectAddressCutNotIPv4(DetectAddress *a, DetectAddress **b)
 {
-    uint32_t a_ip1 = ntohl(a->ip.addr_data32[0]);
-    uint32_t a_ip2 = ntohl(a->ip2.addr_data32[0]);
+    uint32_t a_ip1 = SCNtohl(a->ip.addr_data32[0]);
+    uint32_t a_ip2 = SCNtohl(a->ip2.addr_data32[0]);
     DetectAddress *tmp_b = NULL;
 
     /* default to NULL */
@@ -432,10 +432,10 @@ int DetectAddressJoinIPv4(DetectEngineCtx *de_ctx, DetectAddress *target,
     if (source == NULL || target == NULL)
         return -1;
 
-    if (ntohl(source->ip.addr_data32[0]) < ntohl(target->ip.addr_data32[0]))
+    if (SCNtohl(source->ip.addr_data32[0]) < SCNtohl(target->ip.addr_data32[0]))
         target->ip.addr_data32[0] = source->ip.addr_data32[0];
 
-    if (ntohl(source->ip2.addr_data32[0]) > ntohl(target->ip2.addr_data32[0]))
+    if (SCNtohl(source->ip2.addr_data32[0]) > SCNtohl(target->ip2.addr_data32[0]))
         target->ip2.addr_data32[0] = source->ip2.addr_data32[0];
 
     return 0;
diff --git a/src/detect-engine-address-ipv6.c b/src/detect-engine-address-ipv6.c
index 3ee3cfec40..f4084c131f 100644
--- a/src/detect-engine-address-ipv6.c
+++ b/src/detect-engine-address-ipv6.c
@@ -54,9 +54,9 @@ int AddressIPv6Lt(Address *a, Address *b)
     int i = 0;
 
     for (i = 0; i < 4; i++) {
-        if (ntohl(a->addr_data32[i]) < ntohl(b->addr_data32[i]))
+        if (SCNtohl(a->addr_data32[i]) < SCNtohl(b->addr_data32[i]))
             return 1;
-        if (ntohl(a->addr_data32[i]) > ntohl(b->addr_data32[i]))
+        if (SCNtohl(a->addr_data32[i]) > SCNtohl(b->addr_data32[i]))
             break;
     }
 
@@ -68,9 +68,9 @@ int AddressIPv6LtU32(uint32_t *a, uint32_t *b)
     int i = 0;
 
     for (i = 0; i < 4; i++) {
-        if (ntohl(a[i]) < ntohl(b[i]))
+        if (SCNtohl(a[i]) < SCNtohl(b[i]))
             return 1;
-        if (ntohl(a[i]) > ntohl(b[i]))
+        if (SCNtohl(a[i]) > SCNtohl(b[i]))
             break;
     }
 
@@ -92,9 +92,9 @@ int AddressIPv6Gt(Address *a, Address *b)
     int i = 0;
 
     for (i = 0; i < 4; i++) {
-        if (ntohl(a->addr_data32[i]) > ntohl(b->addr_data32[i]))
+        if (SCNtohl(a->addr_data32[i]) > SCNtohl(b->addr_data32[i]))
             return 1;
-        if (ntohl(a->addr_data32[i]) < ntohl(b->addr_data32[i]))
+        if (SCNtohl(a->addr_data32[i]) < SCNtohl(b->addr_data32[i]))
             break;
     }
 
@@ -106,9 +106,9 @@ int AddressIPv6GtU32(uint32_t *a, uint32_t *b)
     int i = 0;
 
     for (i = 0; i < 4; i++) {
-        if (ntohl(a[i]) > ntohl(b[i]))
+        if (SCNtohl(a[i]) > SCNtohl(b[i]))
             return 1;
-        if (ntohl(a[i]) < ntohl(b[i]))
+        if (SCNtohl(a[i]) < SCNtohl(b[i]))
             break;
     }
 
@@ -359,14 +359,14 @@ static void AddressCutIPv6Copy(uint32_t *a, uint32_t *b)
 int DetectAddressCutIPv6(DetectEngineCtx *de_ctx, DetectAddress *a,
                          DetectAddress *b, DetectAddress **c)
 {
-    uint32_t a_ip1[4] = { ntohl(a->ip.addr_data32[0]), ntohl(a->ip.addr_data32[1]),
-                          ntohl(a->ip.addr_data32[2]), ntohl(a->ip.addr_data32[3]) };
-    uint32_t a_ip2[4] = { ntohl(a->ip2.addr_data32[0]), ntohl(a->ip2.addr_data32[1]),
-                          ntohl(a->ip2.addr_data32[2]), ntohl(a->ip2.addr_data32[3]) };
-    uint32_t b_ip1[4] = { ntohl(b->ip.addr_data32[0]), ntohl(b->ip.addr_data32[1]),
-                          ntohl(b->ip.addr_data32[2]), ntohl(b->ip.addr_data32[3]) };
-    uint32_t b_ip2[4] = { ntohl(b->ip2.addr_data32[0]), ntohl(b->ip2.addr_data32[1]),
-                          ntohl(b->ip2.addr_data32[2]), ntohl(b->ip2.addr_data32[3]) };
+    uint32_t a_ip1[4] = { SCNtohl(a->ip.addr_data32[0]), SCNtohl(a->ip.addr_data32[1]),
+                          SCNtohl(a->ip.addr_data32[2]), SCNtohl(a->ip.addr_data32[3]) };
+    uint32_t a_ip2[4] = { SCNtohl(a->ip2.addr_data32[0]), SCNtohl(a->ip2.addr_data32[1]),
+                          SCNtohl(a->ip2.addr_data32[2]), SCNtohl(a->ip2.addr_data32[3]) };
+    uint32_t b_ip1[4] = { SCNtohl(b->ip.addr_data32[0]), SCNtohl(b->ip.addr_data32[1]),
+                          SCNtohl(b->ip.addr_data32[2]), SCNtohl(b->ip.addr_data32[3]) };
+    uint32_t b_ip2[4] = { SCNtohl(b->ip2.addr_data32[0]), SCNtohl(b->ip2.addr_data32[1]),
+                          SCNtohl(b->ip2.addr_data32[2]), SCNtohl(b->ip2.addr_data32[3]) };
 
     DetectAddress *tmp = NULL;
 
@@ -537,14 +537,14 @@ error:
 int DetectAddressCutIPv6(DetectAddressData *a, DetectAddressData *b,
                          DetectAddressData **c)
 {
-    uint32_t a_ip1[4] = { ntohl(a->ip[0]), ntohl(a->ip[1]),
-                          ntohl(a->ip[2]), ntohl(a->ip[3]) };
-    uint32_t a_ip2[4] = { ntohl(a->ip2[0]), ntohl(a->ip2[1]),
-                          ntohl(a->ip2[2]), ntohl(a->ip2[3]) };
-    uint32_t b_ip1[4] = { ntohl(b->ip[0]), ntohl(b->ip[1]),
-                          ntohl(b->ip[2]), ntohl(b->ip[3]) };
-    uint32_t b_ip2[4] = { ntohl(b->ip2[0]), ntohl(b->ip2[1]),
-                          ntohl(b->ip2[2]), ntohl(b->ip2[3]) };
+    uint32_t a_ip1[4] = { SCNtohl(a->ip[0]), SCNtohl(a->ip[1]),
+                          SCNtohl(a->ip[2]), SCNtohl(a->ip[3]) };
+    uint32_t a_ip2[4] = { SCNtohl(a->ip2[0]), SCNtohl(a->ip2[1]),
+                          SCNtohl(a->ip2[2]), SCNtohl(a->ip2[3]) };
+    uint32_t b_ip1[4] = { SCNtohl(b->ip[0]), SCNtohl(b->ip[1]),
+                          SCNtohl(b->ip[2]), SCNtohl(b->ip[3]) };
+    uint32_t b_ip2[4] = { SCNtohl(b->ip2[0]), SCNtohl(b->ip2[1]),
+                          SCNtohl(b->ip2[2]), SCNtohl(b->ip2[3]) };
 
     /* default to NULL */
     *c = NULL;
@@ -722,10 +722,10 @@ error:
  */
 int DetectAddressCutNotIPv6(DetectAddress *a, DetectAddress **b)
 {
-    uint32_t a_ip1[4] = { ntohl(a->ip.addr_data32[0]), ntohl(a->ip.addr_data32[1]),
-                          ntohl(a->ip.addr_data32[2]), ntohl(a->ip.addr_data32[3]) };
-    uint32_t a_ip2[4] = { ntohl(a->ip2.addr_data32[0]), ntohl(a->ip2.addr_data32[1]),
-                          ntohl(a->ip2.addr_data32[2]), ntohl(a->ip2.addr_data32[3]) };
+    uint32_t a_ip1[4] = { SCNtohl(a->ip.addr_data32[0]), SCNtohl(a->ip.addr_data32[1]),
+                          SCNtohl(a->ip.addr_data32[2]), SCNtohl(a->ip.addr_data32[3]) };
+    uint32_t a_ip2[4] = { SCNtohl(a->ip2.addr_data32[0]), SCNtohl(a->ip2.addr_data32[1]),
+                          SCNtohl(a->ip2.addr_data32[2]), SCNtohl(a->ip2.addr_data32[3]) };
     uint32_t ip_nul[4] = { 0x00000000, 0x00000000, 0x00000000, 0x00000000 };
     uint32_t ip_max[4] = { 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF };
 
@@ -1127,10 +1127,10 @@ static int AddressTestIPv6SubOne01(void)
         return 0;
     memcpy(a, in6.s6_addr, sizeof(in6.s6_addr));
 
-    a[0] = ntohl(a[0]);
-    a[1] = ntohl(a[1]);
-    a[2] = ntohl(a[2]);
-    a[3] = ntohl(a[3]);
+    a[0] = SCNtohl(a[0]);
+    a[1] = SCNtohl(a[1]);
+    a[2] = SCNtohl(a[2]);
+    a[3] = SCNtohl(a[3]);
 
     AddressCutIPv6CopySubOne(a, b);
 
@@ -1156,10 +1156,10 @@ static int AddressTestIPv6SubOne02(void)
         return 0;
     memcpy(a, in6.s6_addr, sizeof(in6.s6_addr));
 
-    a[0] = ntohl(a[0]);
-    a[1] = ntohl(a[1]);
-    a[2] = ntohl(a[2]);
-    a[3] = ntohl(a[3]);
+    a[0] = SCNtohl(a[0]);
+    a[1] = SCNtohl(a[1]);
+    a[2] = SCNtohl(a[2]);
+    a[3] = SCNtohl(a[3]);
 
     AddressCutIPv6CopySubOne(a, b);
 
@@ -1185,10 +1185,10 @@ static int AddressTestIPv6AddOne01(void)
         return 0;
     memcpy(a, in6.s6_addr, sizeof(in6.s6_addr));
 
-    a[0] = ntohl(a[0]);
-    a[1] = ntohl(a[1]);
-    a[2] = ntohl(a[2]);
-    a[3] = ntohl(a[3]);
+    a[0] = SCNtohl(a[0]);
+    a[1] = SCNtohl(a[1]);
+    a[2] = SCNtohl(a[2]);
+    a[3] = SCNtohl(a[3]);
 
     AddressCutIPv6CopyAddOne(a, b);
 
@@ -1214,10 +1214,10 @@ static int AddressTestIPv6AddOne02(void)
         return 0;
     memcpy(a, in6.s6_addr, sizeof(in6.s6_addr));
 
-    a[0] = ntohl(a[0]);
-    a[1] = ntohl(a[1]);
-    a[2] = ntohl(a[2]);
-    a[3] = ntohl(a[3]);
+    a[0] = SCNtohl(a[0]);
+    a[1] = SCNtohl(a[1]);
+    a[2] = SCNtohl(a[2]);
+    a[3] = SCNtohl(a[3]);
 
     AddressCutIPv6CopyAddOne(a, b);
 
diff --git a/src/detect-engine-address.c b/src/detect-engine-address.c
index ded36575dc..c8cc1bea90 100644
--- a/src/detect-engine-address.c
+++ b/src/detect-engine-address.c
@@ -587,7 +587,7 @@ int DetectAddressParseString(DetectAddress *dd, const char *str)
             dd->ip2.addr_data32[0] = in.s_addr;
 
             /* a > b is illegal, a = b is ok */
-            if (ntohl(dd->ip.addr_data32[0]) > ntohl(dd->ip2.addr_data32[0]))
+            if (SCNtohl(dd->ip.addr_data32[0]) > SCNtohl(dd->ip2.addr_data32[0]))
                 goto error;
         } else {
             /* 1.2.3.4 format */
@@ -1706,8 +1706,8 @@ int DetectAddressMatchIPv4(const DetectMatchAddressIPv4 *addrs,
 
     uint16_t idx;
     for (idx = 0; idx < addrs_cnt; idx++) {
-        if (ntohl(a->addr_data32[0]) >= addrs[idx].ip &&
-            ntohl(a->addr_data32[0]) <= addrs[idx].ip2)
+        if (SCNtohl(a->addr_data32[0]) >= addrs[idx].ip &&
+            SCNtohl(a->addr_data32[0]) <= addrs[idx].ip2)
         {
             SCReturnInt(1);
         }
@@ -1750,17 +1750,17 @@ int DetectAddressMatchIPv6(const DetectMatchAddressIPv6 *addrs,
         result1 = result2 = 0;
 
         /* See if packet address equals either limit. Return 1 if true. */
-        if (ntohl(a->addr_data32[0]) == addrs[idx].ip[0] &&
-            ntohl(a->addr_data32[1]) == addrs[idx].ip[1] &&
-            ntohl(a->addr_data32[2]) == addrs[idx].ip[2] &&
-            ntohl(a->addr_data32[3]) == addrs[idx].ip[3])
+        if (SCNtohl(a->addr_data32[0]) == addrs[idx].ip[0] &&
+            SCNtohl(a->addr_data32[1]) == addrs[idx].ip[1] &&
+            SCNtohl(a->addr_data32[2]) == addrs[idx].ip[2] &&
+            SCNtohl(a->addr_data32[3]) == addrs[idx].ip[3])
         {
             SCReturnInt(1);
         }
-        if (ntohl(a->addr_data32[0]) == addrs[idx].ip2[0] &&
-            ntohl(a->addr_data32[1]) == addrs[idx].ip2[1] &&
-            ntohl(a->addr_data32[2]) == addrs[idx].ip2[2] &&
-            ntohl(a->addr_data32[3]) == addrs[idx].ip2[3])
+        if (SCNtohl(a->addr_data32[0]) == addrs[idx].ip2[0] &&
+            SCNtohl(a->addr_data32[1]) == addrs[idx].ip2[1] &&
+            SCNtohl(a->addr_data32[2]) == addrs[idx].ip2[2] &&
+            SCNtohl(a->addr_data32[3]) == addrs[idx].ip2[3])
         {
             SCReturnInt(1);
         }
@@ -1769,11 +1769,11 @@ int DetectAddressMatchIPv6(const DetectMatchAddressIPv6 *addrs,
          * of the current signature address match pair.
          */
         for (i = 0; i < 4; i++) {
-            if (ntohl(a->addr_data32[i]) > addrs[idx].ip[i]) {
+            if (SCNtohl(a->addr_data32[i]) > addrs[idx].ip[i]) {
                 result1 = 1;
                 break;
             }
-            if (ntohl(a->addr_data32[i]) < addrs[idx].ip[i]) {
+            if (SCNtohl(a->addr_data32[i]) < addrs[idx].ip[i]) {
                 result1 = 0;
                 break;
             }
@@ -1787,11 +1787,11 @@ int DetectAddressMatchIPv6(const DetectMatchAddressIPv6 *addrs,
          * of the current signature address match pair.
          */
         for (i = 0; i < 4; i++) {
-            if (ntohl(a->addr_data32[i]) < addrs[idx].ip2[i]) {
+            if (SCNtohl(a->addr_data32[i]) < addrs[idx].ip2[i]) {
                 result2 = 1;
                 break;
             }
-            if (ntohl(a->addr_data32[i]) > addrs[idx].ip2[i]) {
+            if (SCNtohl(a->addr_data32[i]) > addrs[idx].ip2[i]) {
                 result2 = 0;
                 break;
             }
@@ -1834,10 +1834,10 @@ int DetectAddressMatch(DetectAddress *dd, Address *a)
     switch (a->family) {
         case AF_INET:
 
-            /* XXX figure out a way to not need to do this ntohl if we switch to
+            /* XXX figure out a way to not need to do this SCNtohl if we switch to
              * Address inside DetectAddressData we can do uint8_t checks */
-            if (ntohl(a->addr_data32[0]) >= ntohl(dd->ip.addr_data32[0]) &&
-                ntohl(a->addr_data32[0]) <= ntohl(dd->ip2.addr_data32[0]))
+            if (SCNtohl(a->addr_data32[0]) >= SCNtohl(dd->ip.addr_data32[0]) &&
+                SCNtohl(a->addr_data32[0]) <= SCNtohl(dd->ip2.addr_data32[0]))
             {
                 SCReturnInt(1);
             } else {
@@ -2050,8 +2050,8 @@ static int AddressTestParse02(void)
     DetectAddress *dd = DetectAddressParseSingle("1.2.3.4");
 
     if (dd) {
-        if (dd->ip2.addr_data32[0] != ntohl(16909060) ||
-            dd->ip.addr_data32[0] != ntohl(16909060)) {
+        if (dd->ip2.addr_data32[0] != SCNtohl(16909060) ||
+            dd->ip.addr_data32[0] != SCNtohl(16909060)) {
             result = 0;
         }
 
@@ -2081,8 +2081,8 @@ static int AddressTestParse04(void)
     DetectAddress *dd = DetectAddressParseSingle("1.2.3.4/255.255.255.0");
 
     if (dd) {
-        if (dd->ip.addr_data32[0] != ntohl(16909056)||
-            dd->ip2.addr_data32[0] != ntohl(16909311)) {
+        if (dd->ip.addr_data32[0] != SCNtohl(16909056)||
+            dd->ip2.addr_data32[0] != SCNtohl(16909311)) {
             result = 0;
         }
 
@@ -2111,8 +2111,8 @@ static int AddressTestParse06(void)
     DetectAddress *dd = DetectAddressParseSingle("1.2.3.4/24");
 
     if (dd) {
-        if (dd->ip2.addr_data32[0] != ntohl(16909311) ||
-            dd->ip.addr_data32[0] != ntohl(16909056)) {
+        if (dd->ip2.addr_data32[0] != SCNtohl(16909311) ||
+            dd->ip.addr_data32[0] != SCNtohl(16909056)) {
             result = 0;
         }
 
@@ -2141,10 +2141,10 @@ static int AddressTestParse08(void)
     DetectAddress *dd = DetectAddressParseSingle("2001::/3");
 
     if (dd) {
-        if (dd->ip.addr_data32[0] != ntohl(536870912) || dd->ip.addr_data32[1] != 0x00000000 ||
+        if (dd->ip.addr_data32[0] != SCNtohl(536870912) || dd->ip.addr_data32[1] != 0x00000000 ||
             dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != 0x00000000 ||
 
-            dd->ip2.addr_data32[0] != ntohl(1073741823) || dd->ip2.addr_data32[1] != 0xFFFFFFFF ||
+            dd->ip2.addr_data32[0] != SCNtohl(1073741823) || dd->ip2.addr_data32[1] != 0xFFFFFFFF ||
             dd->ip2.addr_data32[2] != 0xFFFFFFFF || dd->ip2.addr_data32[3] != 0xFFFFFFFF) {
             DetectAddressPrint(dd);
             result = 0;
@@ -2175,10 +2175,10 @@ static int AddressTestParse10(void)
     DetectAddress *dd = DetectAddressParseSingle("2001::/128");
 
    if (dd) {
-        if (dd->ip.addr_data32[0] != ntohl(536936448) || dd->ip.addr_data32[1] != 0x00000000 ||
+        if (dd->ip.addr_data32[0] != SCNtohl(536936448) || dd->ip.addr_data32[1] != 0x00000000 ||
             dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != 0x00000000 ||
 
-            dd->ip2.addr_data32[0] != ntohl(536936448) || dd->ip2.addr_data32[1] != 0x00000000 ||
+            dd->ip2.addr_data32[0] != SCNtohl(536936448) || dd->ip2.addr_data32[1] != 0x00000000 ||
             dd->ip2.addr_data32[2] != 0x00000000 || dd->ip2.addr_data32[3] != 0x00000000) {
             DetectAddressPrint(dd);
             result = 0;
@@ -2209,10 +2209,10 @@ static int AddressTestParse12(void)
     DetectAddress *dd = DetectAddressParseSingle("2001::/48");
 
     if (dd) {
-        if (dd->ip.addr_data32[0] != ntohl(536936448) || dd->ip.addr_data32[1] != 0x00000000 ||
+        if (dd->ip.addr_data32[0] != SCNtohl(536936448) || dd->ip.addr_data32[1] != 0x00000000 ||
             dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != 0x00000000 ||
 
-            dd->ip2.addr_data32[0] != ntohl(536936448) || dd->ip2.addr_data32[1] != ntohl(65535) ||
+            dd->ip2.addr_data32[0] != SCNtohl(536936448) || dd->ip2.addr_data32[1] != SCNtohl(65535) ||
             dd->ip2.addr_data32[2] != 0xFFFFFFFF || dd->ip2.addr_data32[3] != 0xFFFFFFFF) {
             DetectAddressPrint(dd);
             result = 0;
@@ -2242,10 +2242,10 @@ static int AddressTestParse14(void)
     DetectAddress *dd = DetectAddressParseSingle("2001::/16");
 
     if (dd) {
-        if (dd->ip.addr_data32[0] != ntohl(536936448) || dd->ip.addr_data32[1] != 0x00000000 ||
+        if (dd->ip.addr_data32[0] != SCNtohl(536936448) || dd->ip.addr_data32[1] != 0x00000000 ||
             dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != 0x00000000 ||
 
-            dd->ip2.addr_data32[0] != ntohl(537001983) || dd->ip2.addr_data32[1] != 0xFFFFFFFF ||
+            dd->ip2.addr_data32[0] != SCNtohl(537001983) || dd->ip2.addr_data32[1] != 0xFFFFFFFF ||
             dd->ip2.addr_data32[2] != 0xFFFFFFFF || dd->ip2.addr_data32[3] != 0xFFFFFFFF) {
             result = 0;
         }
@@ -2308,8 +2308,8 @@ static int AddressTestParse18(void)
     DetectAddress *dd = DetectAddressParseSingle("1.2.3.4-1.2.3.6");
 
     if (dd) {
-        if (dd->ip2.addr_data32[0] != ntohl(16909062) ||
-            dd->ip.addr_data32[0] != ntohl(16909060)) {
+        if (dd->ip2.addr_data32[0] != SCNtohl(16909062) ||
+            dd->ip.addr_data32[0] != SCNtohl(16909060)) {
             result = 0;
         }
 
@@ -2350,11 +2350,11 @@ static int AddressTestParse21(void)
     DetectAddress *dd = DetectAddressParseSingle("2001::1-2001::4");
 
     if (dd) {
-        if (dd->ip.addr_data32[0] != ntohl(536936448) || dd->ip.addr_data32[1] != 0x00000000 ||
-            dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != ntohl(1) ||
+        if (dd->ip.addr_data32[0] != SCNtohl(536936448) || dd->ip.addr_data32[1] != 0x00000000 ||
+            dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != SCNtohl(1) ||
 
-            dd->ip2.addr_data32[0] != ntohl(536936448) || dd->ip2.addr_data32[1] != 0x00000000 ||
-            dd->ip2.addr_data32[2] != 0x00000000 || dd->ip2.addr_data32[3] != ntohl(4)) {
+            dd->ip2.addr_data32[0] != SCNtohl(536936448) || dd->ip2.addr_data32[1] != 0x00000000 ||
+            dd->ip2.addr_data32[2] != 0x00000000 || dd->ip2.addr_data32[3] != SCNtohl(4)) {
             result = 0;
         }
 
@@ -2448,7 +2448,7 @@ static int AddressTestParse28(void)
 
     if (dd) {
         if (dd->flags & ADDRESS_FLAG_NOT &&
-            dd->ip.addr_data32[0] == ntohl(16909060)) {
+            dd->ip.addr_data32[0] == SCNtohl(16909060)) {
             result = 1;
         }
 
@@ -2478,8 +2478,8 @@ static int AddressTestParse30(void)
 
     if (dd) {
         if (dd->flags & ADDRESS_FLAG_NOT &&
-            dd->ip.addr_data32[0] == ntohl(16909056) &&
-            dd->ip2.addr_data32[0] == ntohl(16909311)) {
+            dd->ip.addr_data32[0] == SCNtohl(16909056) &&
+            dd->ip2.addr_data32[0] == SCNtohl(16909311)) {
             result = 1;
         }
 
@@ -2524,8 +2524,8 @@ static int AddressTestParse33(void)
 
     if (dd) {
         if (dd->flags & ADDRESS_FLAG_NOT &&
-            dd->ip.addr_data32[0] == ntohl(536936448) && dd->ip.addr_data32[1] == 0x00000000 &&
-            dd->ip.addr_data32[2] == 0x00000000 && dd->ip.addr_data32[3] == ntohl(1)) {
+            dd->ip.addr_data32[0] == SCNtohl(536936448) && dd->ip.addr_data32[1] == 0x00000000 &&
+            dd->ip.addr_data32[2] == 0x00000000 && dd->ip.addr_data32[3] == SCNtohl(1)) {
             result = 1;
         }
 
@@ -2555,10 +2555,10 @@ static int AddressTestParse35(void)
 
     if (dd) {
         if (dd->flags & ADDRESS_FLAG_NOT &&
-            dd->ip.addr_data32[0] == ntohl(536936448) && dd->ip.addr_data32[1] == 0x00000000 &&
+            dd->ip.addr_data32[0] == SCNtohl(536936448) && dd->ip.addr_data32[1] == 0x00000000 &&
             dd->ip.addr_data32[2] == 0x00000000 && dd->ip.addr_data32[3] == 0x00000000 &&
 
-            dd->ip2.addr_data32[0] == ntohl(537001983) && dd->ip2.addr_data32[1] == 0xFFFFFFFF &&
+            dd->ip2.addr_data32[0] == SCNtohl(537001983) && dd->ip2.addr_data32[1] == 0xFFFFFFFF &&
             dd->ip2.addr_data32[2] == 0xFFFFFFFF && dd->ip2.addr_data32[3] == 0xFFFFFFFF) {
             result = 1;
         }
@@ -2576,7 +2576,7 @@ static int AddressTestParse36(void)
     DetectAddress *dd = DetectAddressParseSingle("ffff::/16");
 
     if (dd) {
-        if (dd->ip.addr_data32[0] != ntohl(0xFFFF0000) || dd->ip.addr_data32[1] != 0x00000000 ||
+        if (dd->ip.addr_data32[0] != SCNtohl(0xFFFF0000) || dd->ip.addr_data32[1] != 0x00000000 ||
             dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != 0x00000000 ||
 
             dd->ip2.addr_data32[0] != 0xFFFFFFFF || dd->ip2.addr_data32[1] != 0xFFFFFFFF ||
@@ -3451,11 +3451,11 @@ static int AddressTestAddressGroupSetup11(void)
                      * 10.10.11.0/10.10.11.1
                      * 10.10.11.2/255.255.255.255
                      */
-                    if (one->ip.addr_data32[0] == 0x00000000 && one->ip2.addr_data32[0] == ntohl(168430079) &&
-                        two->ip.addr_data32[0] == ntohl(168430080) && two->ip2.addr_data32[0] == ntohl(168430089) &&
-                        three->ip.addr_data32[0] == ntohl(168430090) && three->ip2.addr_data32[0] == ntohl(168430335) &&
-                        four->ip.addr_data32[0] == ntohl(168430336) && four->ip2.addr_data32[0] == ntohl(168430337) &&
-                        five->ip.addr_data32[0] == ntohl(168430338) && five->ip2.addr_data32[0]  == 0xFFFFFFFF) {
+                    if (one->ip.addr_data32[0] == 0x00000000 && one->ip2.addr_data32[0] == SCNtohl(168430079) &&
+                        two->ip.addr_data32[0] == SCNtohl(168430080) && two->ip2.addr_data32[0] == SCNtohl(168430089) &&
+                        three->ip.addr_data32[0] == SCNtohl(168430090) && three->ip2.addr_data32[0] == SCNtohl(168430335) &&
+                        four->ip.addr_data32[0] == SCNtohl(168430336) && four->ip2.addr_data32[0] == SCNtohl(168430337) &&
+                        five->ip.addr_data32[0] == SCNtohl(168430338) && five->ip2.addr_data32[0]  == 0xFFFFFFFF) {
                         result = 1;
                     }
                 }
@@ -3490,11 +3490,11 @@ static int AddressTestAddressGroupSetup12 (void)
                      * 10.10.11.0/10.10.11.1
                      * 10.10.11.2/255.255.255.255
                      */
-                    if (one->ip.addr_data32[0] == 0x00000000 && one->ip2.addr_data32[0] == ntohl(168430079) &&
-                        two->ip.addr_data32[0] == ntohl(168430080) && two->ip2.addr_data32[0] == ntohl(168430089) &&
-                        three->ip.addr_data32[0] == ntohl(168430090) && three->ip2.addr_data32[0] == ntohl(168430335) &&
-                        four->ip.addr_data32[0] == ntohl(168430336) && four->ip2.addr_data32[0] == ntohl(168430337) &&
-                        five->ip.addr_data32[0] == ntohl(168430338) && five->ip2.addr_data32[0]  == 0xFFFFFFFF) {
+                    if (one->ip.addr_data32[0] == 0x00000000 && one->ip2.addr_data32[0] == SCNtohl(168430079) &&
+                        two->ip.addr_data32[0] == SCNtohl(168430080) && two->ip2.addr_data32[0] == SCNtohl(168430089) &&
+                        three->ip.addr_data32[0] == SCNtohl(168430090) && three->ip2.addr_data32[0] == SCNtohl(168430335) &&
+                        four->ip.addr_data32[0] == SCNtohl(168430336) && four->ip2.addr_data32[0] == SCNtohl(168430337) &&
+                        five->ip.addr_data32[0] == SCNtohl(168430338) && five->ip2.addr_data32[0]  == 0xFFFFFFFF) {
                         result = 1;
                     }
                 }
@@ -3529,11 +3529,11 @@ static int AddressTestAddressGroupSetup13(void)
                      * 10.10.11.0/10.10.11.1
                      * 10.10.11.2/255.255.255.255
                      */
-                    if (one->ip.addr_data32[0] == 0x00000000 && one->ip2.addr_data32[0] == ntohl(168430079) &&
-                        two->ip.addr_data32[0] == ntohl(168430080) && two->ip2.addr_data32[0] == ntohl(168430089) &&
-                        three->ip.addr_data32[0] == ntohl(168430090) && three->ip2.addr_data32[0] == ntohl(168430335) &&
-                        four->ip.addr_data32[0] == ntohl(168430336) && four->ip2.addr_data32[0] == ntohl(168430337) &&
-                        five->ip.addr_data32[0] == ntohl(168430338) && five->ip2.addr_data32[0]  == 0xFFFFFFFF) {
+                    if (one->ip.addr_data32[0] == 0x00000000 && one->ip2.addr_data32[0] == SCNtohl(168430079) &&
+                        two->ip.addr_data32[0] == SCNtohl(168430080) && two->ip2.addr_data32[0] == SCNtohl(168430089) &&
+                        three->ip.addr_data32[0] == SCNtohl(168430090) && three->ip2.addr_data32[0] == SCNtohl(168430335) &&
+                        four->ip.addr_data32[0] == SCNtohl(168430336) && four->ip2.addr_data32[0] == SCNtohl(168430337) &&
+                        five->ip.addr_data32[0] == SCNtohl(168430338) && five->ip2.addr_data32[0]  == 0xFFFFFFFF) {
                         result = 1;
                     }
                 }
@@ -3561,8 +3561,8 @@ static int AddressTestAddressGroupSetupIPv414(void)
                  * 0.0.0.0/1.2.3.3
                  * 1.2.3.5/255.255.255.255
                  */
-                if (one->ip.addr_data32[0] == 0x00000000 && one->ip2.addr_data32[0] == ntohl(16909059) &&
-                    two->ip.addr_data32[0] == ntohl(16909061) && two->ip2.addr_data32[0] == 0xFFFFFFFF) {
+                if (one->ip.addr_data32[0] == 0x00000000 && one->ip2.addr_data32[0] == SCNtohl(16909059) &&
+                    two->ip.addr_data32[0] == SCNtohl(16909061) && two->ip2.addr_data32[0] == 0xFFFFFFFF) {
                     result = 1;
                 } else {
                     printf("unexpected addresses: ");
@@ -3593,7 +3593,7 @@ static int AddressTestAddressGroupSetupIPv415(void)
                 /* result should be:
                  * 0.0.0.1/255.255.255.255
                  */
-                if (one->ip.addr_data32[0] == ntohl(1) && one->ip2.addr_data32[0] == 0xFFFFFFFF)
+                if (one->ip.addr_data32[0] == SCNtohl(1) && one->ip2.addr_data32[0] == 0xFFFFFFFF)
                     result = 1;
             }
         }
@@ -3617,7 +3617,7 @@ static int AddressTestAddressGroupSetupIPv416(void)
                 /* result should be:
                  * 0.0.0.0/255.255.255.254
                  */
-                if (one->ip.addr_data32[0] == 0x00000000 && one->ip2.addr_data32[0] == ntohl(4294967294))
+                if (one->ip.addr_data32[0] == 0x00000000 && one->ip2.addr_data32[0] == SCNtohl(4294967294))
                     result = 1;
             }
         }
@@ -3860,39 +3860,39 @@ static int AddressTestAddressGroupSetup24(void)
                         one->ip.addr_data32[1] == 0x00000000 &&
                         one->ip.addr_data32[2] == 0x00000000 &&
                         one->ip.addr_data32[3] == 0x00000000 &&
-                        one->ip2.addr_data32[0] == ntohl(536870911) &&
+                        one->ip2.addr_data32[0] == SCNtohl(536870911) &&
                         one->ip2.addr_data32[1] == 0xFFFFFFFF &&
                         one->ip2.addr_data32[2] == 0xFFFFFFFF &&
                         one->ip2.addr_data32[3] == 0xFFFFFFFF &&
 
-                        two->ip.addr_data32[0] == ntohl(536870912) &&
+                        two->ip.addr_data32[0] == SCNtohl(536870912) &&
                         two->ip.addr_data32[1] == 0x00000000 &&
                         two->ip.addr_data32[2] == 0x00000000 &&
                         two->ip.addr_data32[3] == 0x00000000 &&
-                        two->ip2.addr_data32[0] == ntohl(536936448) &&
+                        two->ip2.addr_data32[0] == SCNtohl(536936448) &&
                         two->ip2.addr_data32[1] == 0x00000000 &&
                         two->ip2.addr_data32[2] == 0x00000000 &&
-                        two->ip2.addr_data32[3] == ntohl(3) &&
+                        two->ip2.addr_data32[3] == SCNtohl(3) &&
 
-                        three->ip.addr_data32[0] == ntohl(536936448) &&
+                        three->ip.addr_data32[0] == SCNtohl(536936448) &&
                         three->ip.addr_data32[1] == 0x00000000 &&
                         three->ip.addr_data32[2] == 0x00000000 &&
-                        three->ip.addr_data32[3] == ntohl(4) &&
-                        three->ip2.addr_data32[0] == ntohl(536936448) &&
+                        three->ip.addr_data32[3] == SCNtohl(4) &&
+                        three->ip2.addr_data32[0] == SCNtohl(536936448) &&
                         three->ip2.addr_data32[1] == 0x00000000 &&
                         three->ip2.addr_data32[2] == 0x00000000 &&
-                        three->ip2.addr_data32[3] == ntohl(6) &&
+                        three->ip2.addr_data32[3] == SCNtohl(6) &&
 
-                        four->ip.addr_data32[0] == ntohl(536936448) &&
+                        four->ip.addr_data32[0] == SCNtohl(536936448) &&
                         four->ip.addr_data32[1] == 0x00000000 &&
                         four->ip.addr_data32[2] == 0x00000000 &&
-                        four->ip.addr_data32[3] == ntohl(7) &&
-                        four->ip2.addr_data32[0] == ntohl(1073741823) &&
+                        four->ip.addr_data32[3] == SCNtohl(7) &&
+                        four->ip2.addr_data32[0] == SCNtohl(1073741823) &&
                         four->ip2.addr_data32[1] == 0xFFFFFFFF &&
                         four->ip2.addr_data32[2] == 0xFFFFFFFF &&
                         four->ip2.addr_data32[3] == 0xFFFFFFFF &&
 
-                        five->ip.addr_data32[0] == ntohl(1073741824) &&
+                        five->ip.addr_data32[0] == SCNtohl(1073741824) &&
                         five->ip.addr_data32[1] == 0x00000000 &&
                         five->ip.addr_data32[2] == 0x00000000 &&
                         five->ip.addr_data32[3] == 0x00000000 &&
@@ -3930,39 +3930,39 @@ static int AddressTestAddressGroupSetup25(void)
                         one->ip.addr_data32[1] == 0x00000000 &&
                         one->ip.addr_data32[2] == 0x00000000 &&
                         one->ip.addr_data32[3] == 0x00000000 &&
-                        one->ip2.addr_data32[0]  == ntohl(536870911) &&
+                        one->ip2.addr_data32[0]  == SCNtohl(536870911) &&
                         one->ip2.addr_data32[1]  == 0xFFFFFFFF &&
                         one->ip2.addr_data32[2]  == 0xFFFFFFFF &&
                         one->ip2.addr_data32[3]  == 0xFFFFFFFF &&
 
-                        two->ip.addr_data32[0] == ntohl(536870912) &&
+                        two->ip.addr_data32[0] == SCNtohl(536870912) &&
                         two->ip.addr_data32[1] == 0x00000000 &&
                         two->ip.addr_data32[2] == 0x00000000 &&
                         two->ip.addr_data32[3] == 0x00000000 &&
-                        two->ip2.addr_data32[0] == ntohl(536936448) &&
+                        two->ip2.addr_data32[0] == SCNtohl(536936448) &&
                         two->ip2.addr_data32[1] == 0x00000000 &&
                         two->ip2.addr_data32[2] == 0x00000000 &&
-                        two->ip2.addr_data32[3] == ntohl(3) &&
+                        two->ip2.addr_data32[3] == SCNtohl(3) &&
 
-                        three->ip.addr_data32[0] == ntohl(536936448) &&
+                        three->ip.addr_data32[0] == SCNtohl(536936448) &&
                         three->ip.addr_data32[1] == 0x00000000 &&
                         three->ip.addr_data32[2] == 0x00000000 &&
-                        three->ip.addr_data32[3] == ntohl(4) &&
-                        three->ip2.addr_data32[0] == ntohl(536936448) &&
+                        three->ip.addr_data32[3] == SCNtohl(4) &&
+                        three->ip2.addr_data32[0] == SCNtohl(536936448) &&
                         three->ip2.addr_data32[1] == 0x00000000 &&
                         three->ip2.addr_data32[2] == 0x00000000 &&
-                        three->ip2.addr_data32[3] == ntohl(6) &&
+                        three->ip2.addr_data32[3] == SCNtohl(6) &&
 
-                        four->ip.addr_data32[0] == ntohl(536936448) &&
+                        four->ip.addr_data32[0] == SCNtohl(536936448) &&
                         four->ip.addr_data32[1] == 0x00000000 &&
                         four->ip.addr_data32[2] == 0x00000000 &&
-                        four->ip.addr_data32[3] == ntohl(7) &&
-                        four->ip2.addr_data32[0] == ntohl(1073741823) &&
+                        four->ip.addr_data32[3] == SCNtohl(7) &&
+                        four->ip2.addr_data32[0] == SCNtohl(1073741823) &&
                         four->ip2.addr_data32[1] == 0xFFFFFFFF &&
                         four->ip2.addr_data32[2] == 0xFFFFFFFF &&
                         four->ip2.addr_data32[3] == 0xFFFFFFFF &&
 
-                        five->ip.addr_data32[0] == ntohl(1073741824) &&
+                        five->ip.addr_data32[0] == SCNtohl(1073741824) &&
                         five->ip.addr_data32[1] == 0x00000000 &&
                         five->ip.addr_data32[2] == 0x00000000 &&
                         five->ip.addr_data32[3] == 0x00000000 &&
@@ -4000,39 +4000,39 @@ static int AddressTestAddressGroupSetup26(void)
                         one->ip.addr_data32[1] == 0x00000000 &&
                         one->ip.addr_data32[2] == 0x00000000 &&
                         one->ip.addr_data32[3] == 0x00000000 &&
-                        one->ip2.addr_data32[0] == ntohl(536870911) &&
+                        one->ip2.addr_data32[0] == SCNtohl(536870911) &&
                         one->ip2.addr_data32[1] == 0xFFFFFFFF &&
                         one->ip2.addr_data32[2] == 0xFFFFFFFF &&
                         one->ip2.addr_data32[3] == 0xFFFFFFFF &&
 
-                        two->ip.addr_data32[0] == ntohl(536870912) &&
+                        two->ip.addr_data32[0] == SCNtohl(536870912) &&
                         two->ip.addr_data32[1] == 0x00000000 &&
                         two->ip.addr_data32[2] == 0x00000000 &&
                         two->ip.addr_data32[3] == 0x00000000 &&
-                        two->ip2.addr_data32[0] == ntohl(536936448) &&
+                        two->ip2.addr_data32[0] == SCNtohl(536936448) &&
                         two->ip2.addr_data32[1] == 0x00000000 &&
                         two->ip2.addr_data32[2] == 0x00000000 &&
-                        two->ip2.addr_data32[3] == ntohl(3) &&
+                        two->ip2.addr_data32[3] == SCNtohl(3) &&
 
-                        three->ip.addr_data32[0] == ntohl(536936448) &&
+                        three->ip.addr_data32[0] == SCNtohl(536936448) &&
                         three->ip.addr_data32[1] == 0x00000000 &&
                         three->ip.addr_data32[2] == 0x00000000 &&
-                        three->ip.addr_data32[3] == ntohl(4) &&
-                        three->ip2.addr_data32[0] == ntohl(536936448) &&
+                        three->ip.addr_data32[3] == SCNtohl(4) &&
+                        three->ip2.addr_data32[0] == SCNtohl(536936448) &&
                         three->ip2.addr_data32[1] == 0x00000000 &&
                         three->ip2.addr_data32[2] == 0x00000000 &&
-                        three->ip2.addr_data32[3] == ntohl(6) &&
+                        three->ip2.addr_data32[3] == SCNtohl(6) &&
 
-                        four->ip.addr_data32[0] == ntohl(536936448) &&
+                        four->ip.addr_data32[0] == SCNtohl(536936448) &&
                         four->ip.addr_data32[1] == 0x00000000 &&
                         four->ip.addr_data32[2] == 0x00000000 &&
-                        four->ip.addr_data32[3] == ntohl(7) &&
-                        four->ip2.addr_data32[0] == ntohl(1073741823) &&
+                        four->ip.addr_data32[3] == SCNtohl(7) &&
+                        four->ip2.addr_data32[0] == SCNtohl(1073741823) &&
                         four->ip2.addr_data32[1] == 0xFFFFFFFF &&
                         four->ip2.addr_data32[2] == 0xFFFFFFFF &&
                         four->ip2.addr_data32[3] == 0xFFFFFFFF &&
 
-                        five->ip.addr_data32[0] == ntohl(1073741824) &&
+                        five->ip.addr_data32[0] == SCNtohl(1073741824) &&
                         five->ip.addr_data32[1] == 0x00000000 &&
                         five->ip.addr_data32[2] == 0x00000000 &&
                         five->ip.addr_data32[3] == 0x00000000 &&
@@ -4491,11 +4491,11 @@ static int AddressTestCutIPv403(void)
     if (c == NULL)
         goto error;
 
-    if (a->ip.addr_data32[0] != ntohl(16908800) || a->ip2.addr_data32[0] != ntohl(16909055))
+    if (a->ip.addr_data32[0] != SCNtohl(16908800) || a->ip2.addr_data32[0] != SCNtohl(16909055))
         goto error;
-    if (b->ip.addr_data32[0] != ntohl(16909056) || b->ip2.addr_data32[0] != ntohl(16909060))
+    if (b->ip.addr_data32[0] != SCNtohl(16909056) || b->ip2.addr_data32[0] != SCNtohl(16909060))
         goto error;
-    if (c->ip.addr_data32[0] != ntohl(16909061) || c->ip2.addr_data32[0] != ntohl(16909311))
+    if (c->ip.addr_data32[0] != SCNtohl(16909061) || c->ip2.addr_data32[0] != SCNtohl(16909311))
         goto error;
 
     DetectAddressFree(a);
@@ -4522,11 +4522,11 @@ static int AddressTestCutIPv404(void)
     if (c == NULL)
         goto error;
 
-    if (a->ip.addr_data32[0] != ntohl(16909056) || a->ip2.addr_data32[0] != ntohl(16909058))
+    if (a->ip.addr_data32[0] != SCNtohl(16909056) || a->ip2.addr_data32[0] != SCNtohl(16909058))
         goto error;
-    if (b->ip.addr_data32[0] != ntohl(16909059) || b->ip2.addr_data32[0] != ntohl(16909061))
+    if (b->ip.addr_data32[0] != SCNtohl(16909059) || b->ip2.addr_data32[0] != SCNtohl(16909061))
         goto error;
-    if (c->ip.addr_data32[0] != ntohl(16909062) || c->ip2.addr_data32[0] != ntohl(16909062))
+    if (c->ip.addr_data32[0] != SCNtohl(16909062) || c->ip2.addr_data32[0] != SCNtohl(16909062))
         goto error;
 
 
@@ -4554,11 +4554,11 @@ static int AddressTestCutIPv405(void)
     if (c == NULL)
         goto error;
 
-    if (a->ip.addr_data32[0] != ntohl(16909056) || a->ip2.addr_data32[0] != ntohl(16909058))
+    if (a->ip.addr_data32[0] != SCNtohl(16909056) || a->ip2.addr_data32[0] != SCNtohl(16909058))
         goto error;
-    if (b->ip.addr_data32[0] != ntohl(16909059) || b->ip2.addr_data32[0] != ntohl(16909062))
+    if (b->ip.addr_data32[0] != SCNtohl(16909059) || b->ip2.addr_data32[0] != SCNtohl(16909062))
         goto error;
-    if (c->ip.addr_data32[0] != ntohl(16909063) || c->ip2.addr_data32[0] != ntohl(16909065))
+    if (c->ip.addr_data32[0] != SCNtohl(16909063) || c->ip2.addr_data32[0] != SCNtohl(16909065))
         goto error;
 
     DetectAddressFree(a);
@@ -4585,11 +4585,11 @@ static int AddressTestCutIPv406(void)
     if (c == NULL)
         goto error;
 
-    if (a->ip.addr_data32[0] != ntohl(16909056) || a->ip2.addr_data32[0] != ntohl(16909058))
+    if (a->ip.addr_data32[0] != SCNtohl(16909056) || a->ip2.addr_data32[0] != SCNtohl(16909058))
         goto error;
-    if (b->ip.addr_data32[0] != ntohl(16909059) || b->ip2.addr_data32[0] != ntohl(16909062))
+    if (b->ip.addr_data32[0] != SCNtohl(16909059) || b->ip2.addr_data32[0] != SCNtohl(16909062))
         goto error;
-    if (c->ip.addr_data32[0] != ntohl(16909063) || c->ip2.addr_data32[0] != ntohl(16909065))
+    if (c->ip.addr_data32[0] != SCNtohl(16909063) || c->ip2.addr_data32[0] != SCNtohl(16909065))
         goto error;
 
     DetectAddressFree(a);
@@ -4616,9 +4616,9 @@ static int AddressTestCutIPv407(void)
     if (c != NULL)
         goto error;
 
-    if (a->ip.addr_data32[0] != ntohl(16909056) || a->ip2.addr_data32[0] != ntohl(16909062))
+    if (a->ip.addr_data32[0] != SCNtohl(16909056) || a->ip2.addr_data32[0] != SCNtohl(16909062))
         goto error;
-    if (b->ip.addr_data32[0] != ntohl(16909063) || b->ip2.addr_data32[0] != ntohl(16909065))
+    if (b->ip.addr_data32[0] != SCNtohl(16909063) || b->ip2.addr_data32[0] != SCNtohl(16909065))
         goto error;
 
     DetectAddressFree(a);
@@ -4645,9 +4645,9 @@ static int AddressTestCutIPv408(void)
     if (c != NULL)
         goto error;
 
-    if (a->ip.addr_data32[0] != ntohl(16909056) || a->ip2.addr_data32[0] != ntohl(16909058))
+    if (a->ip.addr_data32[0] != SCNtohl(16909056) || a->ip2.addr_data32[0] != SCNtohl(16909058))
         goto error;
-    if (b->ip.addr_data32[0] != ntohl(16909059) || b->ip2.addr_data32[0] != ntohl(16909065))
+    if (b->ip.addr_data32[0] != SCNtohl(16909059) || b->ip2.addr_data32[0] != SCNtohl(16909065))
         goto error;
 
     DetectAddressFree(a);
@@ -4674,9 +4674,9 @@ static int AddressTestCutIPv409(void)
     if (c != NULL)
         goto error;
 
-    if (a->ip.addr_data32[0] != ntohl(16909056) || a->ip2.addr_data32[0] != ntohl(16909062))
+    if (a->ip.addr_data32[0] != SCNtohl(16909056) || a->ip2.addr_data32[0] != SCNtohl(16909062))
         goto error;
-    if (b->ip.addr_data32[0] != ntohl(16909063) || b->ip2.addr_data32[0] != ntohl(16909065))
+    if (b->ip.addr_data32[0] != SCNtohl(16909063) || b->ip2.addr_data32[0] != SCNtohl(16909065))
         goto error;
 
     DetectAddressFree(a);
@@ -4703,9 +4703,9 @@ static int AddressTestCutIPv410(void)
     if (c != NULL)
         goto error;
 
-    if (a->ip.addr_data32[0] != ntohl(16909056) || a->ip2.addr_data32[0] != ntohl(16909058))
+    if (a->ip.addr_data32[0] != SCNtohl(16909056) || a->ip2.addr_data32[0] != SCNtohl(16909058))
         goto error;
-    if (b->ip.addr_data32[0] != ntohl(16909059) || b->ip2.addr_data32[0] != ntohl(16909065))
+    if (b->ip.addr_data32[0] != SCNtohl(16909059) || b->ip2.addr_data32[0] != SCNtohl(16909065))
         goto error;
 
     printf("ip %u ip2 %u ", htonl(a->ip.addr_data32[0]), htonl(a->ip2.addr_data32[0]));
diff --git a/src/detect-engine-iponly.c b/src/detect-engine-iponly.c
index 0bf283f256..af19ebe69a 100644
--- a/src/detect-engine-iponly.c
+++ b/src/detect-engine-iponly.c
@@ -211,11 +211,11 @@ static int IPOnlyCIDRItemParseSingle(IPOnlyCIDRItem *dd, const char *str)
             tmp_ip2[0] = in.s_addr;
 
             /* a > b is illegal, a = b is ok */
-            if (ntohl(tmp_ip[0]) > ntohl(tmp_ip2[0]))
+            if (SCNtohl(tmp_ip[0]) > SCNtohl(tmp_ip2[0]))
                 goto error;
 
-            first = ntohl(tmp_ip[0]);
-            last = ntohl(tmp_ip2[0]);
+            first = SCNtohl(tmp_ip[0]);
+            last = SCNtohl(tmp_ip2[0]);
 
             dd->netmask = 32;
             dd->ip[0] =htonl(first);
diff --git a/src/detect-geoip.c b/src/detect-geoip.c
index 29fab52f0a..dfda987206 100644
--- a/src/detect-geoip.c
+++ b/src/detect-geoip.c
@@ -104,7 +104,7 @@ static GeoIP *InitGeolocationEngine(void)
 static const char *GeolocateIPv4(GeoIP *geoengine, uint32_t ip)
 {
     if (geoengine != NULL)
-        return GeoIP_country_code_by_ipnum(geoengine,  ntohl(ip));
+        return GeoIP_country_code_by_ipnum(geoengine,  SCNtohl(ip));
     return NULL;
 }
 
diff --git a/src/detect-icmp-id.c b/src/detect-icmp-id.c
index 1c8b5b1ff3..310bc3ce76 100644
--- a/src/detect-icmp-id.c
+++ b/src/detect-icmp-id.c
@@ -88,7 +88,7 @@ static inline _Bool GetIcmpId(Packet *p, uint16_t *id)
             case ICMP_ADDRESSREPLY:
                 SCLogDebug("ICMPV4_GET_ID(p) %"PRIu16" (network byte order), "
                         "%"PRIu16" (host byte order)", ICMPV4_GET_ID(p),
-                        ntohs(ICMPV4_GET_ID(p)));
+                        SCNtohs(ICMPV4_GET_ID(p)));
 
                 pid = ICMPV4_GET_ID(p);
                 break;
@@ -102,7 +102,7 @@ static inline _Bool GetIcmpId(Packet *p, uint16_t *id)
             case ICMP6_ECHO_REPLY:
                 SCLogDebug("ICMPV6_GET_ID(p) %"PRIu16" (network byte order), "
                         "%"PRIu16" (host byte order)", ICMPV6_GET_ID(p),
-                        ntohs(ICMPV6_GET_ID(p)));
+                        SCNtohs(ICMPV6_GET_ID(p)));
 
                 pid = ICMPV6_GET_ID(p);
                 break;
diff --git a/src/detect-icmp-seq.c b/src/detect-icmp-seq.c
index 60a3e58cff..04290084e0 100644
--- a/src/detect-icmp-seq.c
+++ b/src/detect-icmp-seq.c
@@ -89,7 +89,7 @@ static inline _Bool GetIcmpSeq(Packet *p, uint16_t *seq)
             case ICMP_ADDRESSREPLY:
                 SCLogDebug("ICMPV4_GET_SEQ(p) %"PRIu16" (network byte order), "
                         "%"PRIu16" (host byte order)", ICMPV4_GET_SEQ(p),
-                        ntohs(ICMPV4_GET_SEQ(p)));
+                        SCNtohs(ICMPV4_GET_SEQ(p)));
 
                 seqn = ICMPV4_GET_SEQ(p);
                 break;
@@ -104,7 +104,7 @@ static inline _Bool GetIcmpSeq(Packet *p, uint16_t *seq)
             case ICMP6_ECHO_REPLY:
                 SCLogDebug("ICMPV6_GET_SEQ(p) %"PRIu16" (network byte order), "
                         "%"PRIu16" (host byte order)", ICMPV6_GET_SEQ(p),
-                        ntohs(ICMPV6_GET_SEQ(p)));
+                        SCNtohs(ICMPV6_GET_SEQ(p)));
 
                 seqn = ICMPV6_GET_SEQ(p);
                 break;
diff --git a/src/detect-parse.c b/src/detect-parse.c
index 71eea60f3e..c24c1cf88d 100644
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -1342,8 +1342,8 @@ static void SigBuildAddressMatchArray(Signature *s)
         }
 
         for (da = s->init_data->src->ipv4_head; da != NULL; da = da->next) {
-            s->addr_src_match4[idx].ip = ntohl(da->ip.addr_data32[0]);
-            s->addr_src_match4[idx].ip2 = ntohl(da->ip2.addr_data32[0]);
+            s->addr_src_match4[idx].ip = SCNtohl(da->ip.addr_data32[0]);
+            s->addr_src_match4[idx].ip2 = SCNtohl(da->ip2.addr_data32[0]);
             idx++;
         }
         s->addr_src_match4_cnt = cnt;
@@ -1363,8 +1363,8 @@ static void SigBuildAddressMatchArray(Signature *s)
         }
 
         for (da = s->init_data->dst->ipv4_head; da != NULL; da = da->next) {
-            s->addr_dst_match4[idx].ip = ntohl(da->ip.addr_data32[0]);
-            s->addr_dst_match4[idx].ip2 = ntohl(da->ip2.addr_data32[0]);
+            s->addr_dst_match4[idx].ip = SCNtohl(da->ip.addr_data32[0]);
+            s->addr_dst_match4[idx].ip2 = SCNtohl(da->ip2.addr_data32[0]);
             idx++;
         }
         s->addr_dst_match4_cnt = cnt;
@@ -1384,14 +1384,14 @@ static void SigBuildAddressMatchArray(Signature *s)
         }
 
         for (da = s->init_data->src->ipv6_head; da != NULL; da = da->next) {
-            s->addr_src_match6[idx].ip[0] = ntohl(da->ip.addr_data32[0]);
-            s->addr_src_match6[idx].ip[1] = ntohl(da->ip.addr_data32[1]);
-            s->addr_src_match6[idx].ip[2] = ntohl(da->ip.addr_data32[2]);
-            s->addr_src_match6[idx].ip[3] = ntohl(da->ip.addr_data32[3]);
-            s->addr_src_match6[idx].ip2[0] = ntohl(da->ip2.addr_data32[0]);
-            s->addr_src_match6[idx].ip2[1] = ntohl(da->ip2.addr_data32[1]);
-            s->addr_src_match6[idx].ip2[2] = ntohl(da->ip2.addr_data32[2]);
-            s->addr_src_match6[idx].ip2[3] = ntohl(da->ip2.addr_data32[3]);
+            s->addr_src_match6[idx].ip[0] = SCNtohl(da->ip.addr_data32[0]);
+            s->addr_src_match6[idx].ip[1] = SCNtohl(da->ip.addr_data32[1]);
+            s->addr_src_match6[idx].ip[2] = SCNtohl(da->ip.addr_data32[2]);
+            s->addr_src_match6[idx].ip[3] = SCNtohl(da->ip.addr_data32[3]);
+            s->addr_src_match6[idx].ip2[0] = SCNtohl(da->ip2.addr_data32[0]);
+            s->addr_src_match6[idx].ip2[1] = SCNtohl(da->ip2.addr_data32[1]);
+            s->addr_src_match6[idx].ip2[2] = SCNtohl(da->ip2.addr_data32[2]);
+            s->addr_src_match6[idx].ip2[3] = SCNtohl(da->ip2.addr_data32[3]);
             idx++;
         }
         s->addr_src_match6_cnt = cnt;
@@ -1411,14 +1411,14 @@ static void SigBuildAddressMatchArray(Signature *s)
         }
 
         for (da = s->init_data->dst->ipv6_head; da != NULL; da = da->next) {
-            s->addr_dst_match6[idx].ip[0] = ntohl(da->ip.addr_data32[0]);
-            s->addr_dst_match6[idx].ip[1] = ntohl(da->ip.addr_data32[1]);
-            s->addr_dst_match6[idx].ip[2] = ntohl(da->ip.addr_data32[2]);
-            s->addr_dst_match6[idx].ip[3] = ntohl(da->ip.addr_data32[3]);
-            s->addr_dst_match6[idx].ip2[0] = ntohl(da->ip2.addr_data32[0]);
-            s->addr_dst_match6[idx].ip2[1] = ntohl(da->ip2.addr_data32[1]);
-            s->addr_dst_match6[idx].ip2[2] = ntohl(da->ip2.addr_data32[2]);
-            s->addr_dst_match6[idx].ip2[3] = ntohl(da->ip2.addr_data32[3]);
+            s->addr_dst_match6[idx].ip[0] = SCNtohl(da->ip.addr_data32[0]);
+            s->addr_dst_match6[idx].ip[1] = SCNtohl(da->ip.addr_data32[1]);
+            s->addr_dst_match6[idx].ip[2] = SCNtohl(da->ip.addr_data32[2]);
+            s->addr_dst_match6[idx].ip[3] = SCNtohl(da->ip.addr_data32[3]);
+            s->addr_dst_match6[idx].ip2[0] = SCNtohl(da->ip2.addr_data32[0]);
+            s->addr_dst_match6[idx].ip2[1] = SCNtohl(da->ip2.addr_data32[1]);
+            s->addr_dst_match6[idx].ip2[2] = SCNtohl(da->ip2.addr_data32[2]);
+            s->addr_dst_match6[idx].ip2[3] = SCNtohl(da->ip2.addr_data32[3]);
             idx++;
         }
         s->addr_dst_match6_cnt = cnt;
diff --git a/src/detect-rpc.c b/src/detect-rpc.c
index 2cfa721f2b..d40733f48d 100644
--- a/src/detect-rpc.c
+++ b/src/detect-rpc.c
@@ -112,25 +112,25 @@ static int DetectRpcMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet
         return 0;
     }
 
-    /* Point through the rpc msg structure. Use ntohl() to compare values */
+    /* Point through the rpc msg structure. Use SCNtohl() to compare values */
     RpcMsg *msg = (RpcMsg *)rpcmsg;
 
     /* If its not a call, no match */
-    if (ntohl(msg->type) != 0) {
+    if (SCNtohl(msg->type) != 0) {
         SCLogDebug("RPC message type is not a call");
         return 0;
     }
 
-    if (ntohl(msg->prog) != rd->program)
+    if (SCNtohl(msg->prog) != rd->program)
         return 0;
 
-    if ((rd->flags & DETECT_RPC_CHECK_VERSION) && ntohl(msg->vers) != rd->program_version)
+    if ((rd->flags & DETECT_RPC_CHECK_VERSION) && SCNtohl(msg->vers) != rd->program_version)
         return 0;
 
-    if ((rd->flags & DETECT_RPC_CHECK_PROCEDURE) && ntohl(msg->proc) != rd->procedure)
+    if ((rd->flags & DETECT_RPC_CHECK_PROCEDURE) && SCNtohl(msg->proc) != rd->procedure)
         return 0;
 
-    SCLogDebug("prog:%u pver:%u proc:%u matched", ntohl(msg->prog), ntohl(msg->vers), ntohl(msg->proc));
+    SCLogDebug("prog:%u pver:%u proc:%u matched", SCNtohl(msg->prog), SCNtohl(msg->vers), SCNtohl(msg->proc));
     return 1;
 }
 
diff --git a/src/detect-rpc.h b/src/detect-rpc.h
index 6a5bc6c7f6..3a8c54018f 100644
--- a/src/detect-rpc.h
+++ b/src/detect-rpc.h
@@ -42,7 +42,7 @@ typedef struct RpcMsg_ {
 } RpcMsg;
 
 /* Extract uint32_t */
-#define EXT_GET_UINT32T(buf)      ((long)ntohl((long)*(buf)++))
+#define EXT_GET_UINT32T(buf)      ((long)SCNtohl((long)*(buf)++))
 
 typedef struct DetectRpcData_ {
     uint32_t program;
diff --git a/src/flow-hash.c b/src/flow-hash.c
index d5d3ee4092..ff94df89a3 100644
--- a/src/flow-hash.c
+++ b/src/flow-hash.c
@@ -58,7 +58,7 @@ static Flow *FlowGetUsedFlow(ThreadVars *tv, DecodeThreadVars *dtv);
  *
  *  \note we don't care about the real ipv6 ip's, this is just
  *        to consistently fill the FlowHashKey6 struct, without all
- *        the ntohl calls.
+ *        the SCNtohl calls.
  *
  *  \warning do not use elsewhere unless you know what you're doing.
  *           detect-engine-address-ipv6.c's AddressIPv6GtU32 is likely
diff --git a/src/ippair.c b/src/ippair.c
index fce430c846..1d7c899082 100644
--- a/src/ippair.c
+++ b/src/ippair.c
@@ -381,7 +381,7 @@ void IPPairCleanup(void)
  *
  *  \note we don't care about the real ipv6 ip's, this is just
  *        to consistently fill the FlowHashKey6 struct, without all
- *        the ntohl calls.
+ *        the SCNtohl calls.
  *
  *  \warning do not use elsewhere unless you know what you're doing.
  *           detect-engine-address-ipv6.c's AddressIPv6GtU32 is likely
diff --git a/src/source-erf-dag.c b/src/source-erf-dag.c
index 35816386cf..9d4e34fc54 100644
--- a/src/source-erf-dag.c
+++ b/src/source-erf-dag.c
@@ -418,7 +418,7 @@ ProcessErfDagRecords(ErfDagThreadVars *ewtn, uint8_t *top, uint32_t *pkts_read)
 
         prec = (char *)ewtn->btm;
         dr = (dag_record_t*)prec;
-        rlen = ntohs(dr->rlen);
+        rlen = SCNtohs(dr->rlen);
         hdr_type = dr->type;
 
         /* If we don't have enough data to finish processing this ERF
@@ -443,7 +443,7 @@ ProcessErfDagRecords(ErfDagThreadVars *ewtn, uint8_t *top, uint32_t *pkts_read)
             break;
         case TYPE_ETH:
             if (dr->lctr) {
-                StatsAddUI64(ewtn->tv, ewtn->drops, ntohs(dr->lctr));
+                StatsAddUI64(ewtn->tv, ewtn->drops, SCNtohs(dr->lctr));
             }
             break;
         default:
@@ -482,8 +482,8 @@ ProcessErfDagRecord(ErfDagThreadVars *ewtn, char *prec)
     Packet *p;
 
     hdr_type = dr->type;
-    wlen = ntohs(dr->wlen);
-    rlen = ntohs(dr->rlen);
+    wlen = SCNtohs(dr->wlen);
+    rlen = SCNtohs(dr->rlen);
 
     /* count extension headers */
     while (hdr_type & 0x80) {
diff --git a/src/source-erf-file.c b/src/source-erf-file.c
index 7031dfb1d0..f51e8fe79c 100644
--- a/src/source-erf-file.c
+++ b/src/source-erf-file.c
@@ -165,8 +165,8 @@ static inline TmEcode ReadErfRecord(ThreadVars *tv, Packet *p, void *data)
         }
         SCReturnInt(TM_ECODE_FAILED);
     }
-    int rlen = ntohs(dr.rlen);
-    int wlen = ntohs(dr.wlen);
+    int rlen = SCNtohs(dr.rlen);
+    int wlen = SCNtohs(dr.wlen);
     r = fread(GET_PKT_DATA(p), rlen - sizeof(DagRecord), 1, etv->erf);
     if (r < 1) {
         if (feof(etv->erf)) {
diff --git a/src/source-nfq.c b/src/source-nfq.c
index 4c13f5a737..4f1eb6bb78 100644
--- a/src/source-nfq.c
+++ b/src/source-nfq.c
@@ -429,8 +429,8 @@ static int NFQSetupPkt (Packet *p, struct nfq_q_handle *qh, void *data)
 
     ph = nfq_get_msg_packet_hdr(tb);
     if (ph != NULL) {
-        p->nfq_v.id = ntohl(ph->packet_id);
-        //p->nfq_v.hw_protocol = ntohs(p->nfq_v.ph->hw_protocol);
+        p->nfq_v.id = SCNtohl(ph->packet_id);
+        //p->nfq_v.hw_protocol = SCNtohs(p->nfq_v.ph->hw_protocol);
         p->nfq_v.hw_protocol = ph->hw_protocol;
     }
     /* coverity[missing_lock] */
diff --git a/src/stream-tcp-sack.c b/src/stream-tcp-sack.c
index 0d01e5353a..d3f7102736 100644
--- a/src/stream-tcp-sack.c
+++ b/src/stream-tcp-sack.c
@@ -264,26 +264,26 @@ int StreamTcpSackUpdatePacket(TcpStream *stream, Packet *p)
 
     for (record = 0; record < records; record++) {
         SCLogDebug("%p last_ack %u, left edge %u, right edge %u", sack_rec,
-            stream->last_ack, ntohl(sack_rec->le), ntohl(sack_rec->re));
+            stream->last_ack, SCNtohl(sack_rec->le), SCNtohl(sack_rec->re));
 
-        if (SEQ_LEQ(ntohl(sack_rec->re), stream->last_ack)) {
+        if (SEQ_LEQ(SCNtohl(sack_rec->re), stream->last_ack)) {
             SCLogDebug("record before last_ack");
             goto next;
         }
 
-        if (SEQ_GT(ntohl(sack_rec->re), stream->next_win)) {
+        if (SEQ_GT(SCNtohl(sack_rec->re), stream->next_win)) {
             SCLogDebug("record %u:%u beyond next_win %u",
-                    ntohl(sack_rec->le), ntohl(sack_rec->re), stream->next_win);
+                    SCNtohl(sack_rec->le), SCNtohl(sack_rec->re), stream->next_win);
             goto next;
         }
 
-        if (SEQ_GEQ(ntohl(sack_rec->le), ntohl(sack_rec->re))) {
+        if (SEQ_GEQ(SCNtohl(sack_rec->le), SCNtohl(sack_rec->re))) {
             SCLogDebug("invalid record: le >= re");
             goto next;
         }
 
-        if (StreamTcpSackInsertRange(stream, ntohl(sack_rec->le),
-                    ntohl(sack_rec->re)) == -1)
+        if (StreamTcpSackInsertRange(stream, SCNtohl(sack_rec->le),
+                    SCNtohl(sack_rec->re)) == -1)
         {
             SCReturnInt(-1);
         }
diff --git a/src/suricata-common.h b/src/suricata-common.h
index 4e73fe5612..efa2f7e941 100644
--- a/src/suricata-common.h
+++ b/src/suricata-common.h
@@ -373,6 +373,9 @@
     #define SCMkDir(a, b) mkdir(a)
 #endif
 
+#define SCNtohl(x) (uint32_t)ntohl((x))
+#define SCNtohs(x) (uint16_t)ntohs((x))
+
 typedef enum PacketProfileDetectId_ {
     PROF_DETECT_IPONLY,
     PROF_DETECT_RULES,
diff --git a/src/util-unittest-helper.c b/src/util-unittest-helper.c
index bbc662c100..215091975d 100644
--- a/src/util-unittest-helper.c
+++ b/src/util-unittest-helper.c
@@ -968,9 +968,9 @@ static int CheckUTHTestPacket(Packet *p, uint8_t ipproto)
         case IPPROTO_TCP:
             if (p->tcph == NULL)
                 return 0;
-            if (ntohs(p->tcph->th_sport) != sport)
+            if (SCNtohs(p->tcph->th_sport) != sport)
                 return 0;
-            if (ntohs(p->tcph->th_dport) != dport)
+            if (SCNtohs(p->tcph->th_dport) != dport)
                 return 0;
         break;
     }