diff --git a/cmd/ebpf/xdp/n3n6_entrypoint.c b/cmd/ebpf/xdp/n3n6_entrypoint.c
index c1d7d34d..623eda35 100644
--- a/cmd/ebpf/xdp/n3n6_entrypoint.c
+++ b/cmd/ebpf/xdp/n3n6_entrypoint.c
@@ -35,6 +35,7 @@
 #include "xdp/utils/common.h"
 #include "xdp/utils/trace.h"
 #include "xdp/utils/packet_context.h"
+#include "xdp/utils/packet_trace.h"
 #include "xdp/utils/parsers.h"
 #include "xdp/utils/csum.h"
 #include "xdp/utils/gtp_utils.h"
@@ -44,22 +45,6 @@
 
 #define DEFAULT_XDP_ACTION XDP_PASS
 
-#define min(x, y) ((x) < (y) ? (x) : (y))
-#define MAX_CPUS 128
-#define SAMPLE_SIZE 1024ul
-/* Metadata will be in the perf event before the packet data. */
-struct S {
-	__u16 cookie;
-	__u16 pkt_len;
-} __packed;
-
-struct {
-	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
-	__type(key, int);
-	__type(value, __u32);
-	__uint(max_entries, MAX_CPUS);
-} my_map SEC(".maps");
-
 static __always_inline enum xdp_action send_to_gtp_tunnel(struct packet_context *ctx, int srcip, int dstip, __u8 tos, __u8 qfi, int teid) {
     if (-1 == add_gtp_over_ip4_headers(ctx, srcip, dstip, tos, qfi, teid))
         return XDP_ABORTED;
@@ -493,19 +478,10 @@ int upf_ip_entrypoint_func(struct xdp_md *ctx) {
     enum xdp_action action = process_packet(&context);
     statistic->xdp_actions[action & EUPF_MAX_XDP_ACTION_MASK] += 1;
 
-    __u64 flags = BPF_F_CURRENT_CPU;
-    __u16 sample_size = (__u16)(ctx->data_end - ctx->data);
-    int ret;
-    struct S metadata;
-
-    metadata.cookie = 0xdead;
-    metadata.pkt_len = min(sample_size, SAMPLE_SIZE);
-
-    flags |= (__u64)sample_size << 32;
-
-    ret = bpf_perf_event_output(ctx, &my_map, flags, &metadata, sizeof(metadata));
-    if (ret)
-        bpf_printk("perf_event_output failed: %d\n", ret);
+#define PACKET_TRACE
+#ifdef PACKET_TRACE
+    trace_packet(&context);
+#endif
 
     return action;
 }
diff --git a/cmd/ebpf/xdp/utils/packet_trace.h b/cmd/ebpf/xdp/utils/packet_trace.h
new file mode 100644
index 00000000..82171a01
--- /dev/null
+++ b/cmd/ebpf/xdp/utils/packet_trace.h
@@ -0,0 +1,55 @@
+/**
+ * Copyright 2023 Edgecom LLC
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+
+#include "xdp/utils/packet_context.h"
+
+#define min(x, y) ((x) < (y) ? (x) : (y))
+#define MAX_CPUS 128
+#define SAMPLE_SIZE 1024ul
+/* Metadata will be in the perf event before the packet data. */
+struct packet_trace_metadata {
+	__u16 cookie;
+	__u16 pkt_len;
+} __packed;
+
+struct {
+	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
+	__type(key, int);
+	__type(value, __u32);
+	__uint(max_entries, MAX_CPUS);
+} my_map SEC(".maps");
+
+static __always_inline void trace_packet(struct packet_context *ctx) 
+{
+    __u64 flags = BPF_F_CURRENT_CPU;
+    __u16 sample_size = (__u16)(ctx->data_end - ctx->data);
+    int ret;
+    struct packet_trace_metadata meta;
+
+    meta.cookie = 0xdead;
+    meta.pkt_len = min(sample_size, SAMPLE_SIZE);
+
+    flags |= (__u64)sample_size << 32;
+
+    ret = bpf_perf_event_output(ctx, &my_map, flags, &meta, sizeof(meta));
+    if (ret)
+        bpf_printk("perf_event_output failed: %d\n", ret);
+}
\ No newline at end of file
diff --git a/cmd/main.go b/cmd/main.go
index 314cb2eb..c179237a 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -74,12 +74,12 @@ func main() {
 					return
 				}
 
-				magic := binary.BigEndian.Uint16(rec.RawSample[:2])
+				magic := binary.LittleEndian.Uint16(rec.RawSample[:2])
 				if magic != 0xdead {
 					continue
 				}
 
-				len := binary.BigEndian.Uint16(rec.RawSample[2:2])
+				len := binary.LittleEndian.Uint16(rec.RawSample[2:2])
 
 				pack := gopacket.NewPacket(rec.RawSample[4:], layers.LayerTypeEthernet, gopacket.Default)
 				log.Debug().Msgf("Sample: len=%d, packet: %s", len, pack.Dump())