To me this looks right. The manual combination of bytes is correct imho. This is an "invented" byte order that tvheadend writes to the stream. It has nothing to do with ntohl.