diff --git a/include/dot11/dot11_data.h b/include/dot11/dot11_data.h
index 9f42ab0..8e31648 100644
--- a/include/dot11/dot11_data.h
+++ b/include/dot11/dot11_data.h
@@ -196,7 +196,8 @@ protected:
     uint32_t write_ext_header(uint8_t *buffer, uint32_t total_sz);
 
     uint32_t data_frame_size() { 
-        return sizeof(_ext_header) + ((from_ds() && to_ds()) ? sizeof(_addr4) : 0); 
+        return Dot11::header_size() + sizeof(_ext_header) + 
+            ((from_ds() && to_ds()) ? _addr4.size() : 0); 
     }
 private:
     ExtendedHeader _ext_header;
diff --git a/src/dot11/dot11_data.cpp b/src/dot11/dot11_data.cpp
index f140b8c..4db8cb2 100644
--- a/src/dot11/dot11_data.cpp
+++ b/src/dot11/dot11_data.cpp
@@ -154,8 +154,13 @@ Dot11QoSData::Dot11QoSData(const uint8_t *buffer, uint32_t total_sz)
     _qos_control = *(uint16_t*)buffer;
     total_sz -= sizeof(uint16_t);
     buffer += sizeof(uint16_t);
-    if(total_sz)
-        inner_pdu(new Tins::SNAP(buffer, total_sz));
+    if(total_sz) {
+        // If the wep bit is on, then just use a RawPDU
+        if(wep())
+            inner_pdu(new Tins::RawPDU(buffer, total_sz));
+        else
+            inner_pdu(new Tins::SNAP(buffer, total_sz));
+    }
 }
 
 void Dot11QoSData::qos_control(uint16_t new_qos_control) {