i found the answer!.
unsigned short length = ntohs(pIpHeader->ip_len) - ( pIpHeader->ip_hl*4 + pTcpHeader->th_off*4);
can someone say yes or no? 😀