diff --git a/FPEngine.cc b/FPEngine.cc
index bfa5d68..355a9f3 100644
--- a/FPEngine.cc
+++ b/FPEngine.cc
@@ -130,6 +130,7 @@
 #include "nmap_error.h"
 #include "osscan.h"
 #include "linear.h"
+#include "FPModel.h"
 extern NmapOps o;
 
 
@@ -697,14 +698,6 @@ FPEngine6::~FPEngine6() {
 
 }
 
-
-/* From FPModel.cc. */
-extern struct model FPModel;
-extern double FPscale[][2];
-extern double FPmean[][659];
-extern double FPvariance[][659];
-extern FingerMatch FPmatches[];
-
 /* Not all operating systems allow setting the flow label in outgoing packets;
    notably all Unixes other than Linux when using raw sockets. This function
    finds out whether the flow labels we set are likely really being sent.
@@ -784,6 +777,20 @@ static double vectorize_tc(const PacketElement *pe) {
     return ipv6->getTrafficClass();
 }
 
+static int vectorize_hlim(const PacketElement *pe, int target_distance) {
+  const IPv6Header *ipv6;
+  int hlim;
+
+  ipv6 = find_ipv6(pe);
+  if (ipv6 == NULL)
+    return -1;
+  hlim = ipv6->getHopLimit();
+  if (target_distance > 0)
+    hlim += target_distance - 1;
+
+  return hlim;
+}
+
 static double vectorize_isr(std::map<std::string, FPPacket>& resps) {
   const char * const SEQ_PROBE_NAMES[] = {"S1", "S2", "S3", "S4", "S5", "S6"};
   u32 seqs[NELEMS(SEQ_PROBE_NAMES)];
@@ -857,6 +864,7 @@ static struct feature_node *vectorize(const FingerPrintResultsIPv6 *FPR) {
     probe_name = IPV6_PROBE_NAMES[i];
     features[idx++].value = vectorize_plen(resps[probe_name].getPacket());
     features[idx++].value = vectorize_tc(resps[probe_name].getPacket());
+    features[idx++].value = vectorize_hlim(resps[probe_name].getPacket(), FPR->distance);
   }
   /* TCP features */
   features[idx++].value = vectorize_isr(resps);