I am not sure if this is an endian issue.

This is the struct

struct sniff_ethernet {
		u_char ether_dhost[ETHER_ADDR_LEN]; /* Destination host address */
		u_char ether_shost[ETHER_ADDR_LEN]; /* Source host address */
		u_short ether_type; /* IP? ARP? RARP? etc */
	};


The EFF Struct

class Ethernet_header < FFI::Struct
    layout :dhost,[:uchar,6],:shost,[:uchar,6],:type,:short
  end

packet=Pcap::pcap_next @pcap_ptr,pack
  eth_ptr = Pcap::Ethernet_header.new packet
  eth_ptr[:shost].each {|c| puts c}
  puts eth_ptr[:type] #prints 8

packet is a uchar* and the first 14 bytes is the ethernet header.
shost and dhost hold the correct ethernet addresses.  The value I am
expecting is 2048(0x0800) and I am getting 8, which is what makes me
think it is an endian problem.