diff --git a/changelog b/changelog
index b0afe64d0a5f759f0addbc6adc2750bea5340f34..9b76f081e019c73a8ff9fb9c69aaf65357ad4480 100644
--- a/changelog
+++ b/changelog
@@ -16,6 +16,8 @@ User api changes
  - the external poll callbacks now get the socket descriptor coming from the
  	"in" parameter.  The user parameter provides the user_space for the
 	wsi as it normally does on the other callbacks.
+	LWS_CALLBACK_FILTER_NETWORK_CONNECTION also has the socket descriptor
+	delivered by @in now instead of @user.
 
 
 User api removal
diff --git a/lib/libwebsockets.h b/lib/libwebsockets.h
index 779af2edf1856b3ec32b4c5ebc062a71e76ddefe..b7f43fc4b912e5aa8f841347da45772c2860b4cc 100644
--- a/lib/libwebsockets.h
+++ b/lib/libwebsockets.h
@@ -456,7 +456,7 @@ struct libwebsocket_extension;
  *	LWS_CALLBACK_FILTER_NETWORK_CONNECTION: called when a client connects to
  *		the server at network level; the connection is accepted but then
  *		passed to this callback to decide whether to hang up immediately
- *		or not, based on the client IP.  @user contains the connection
+ *		or not, based on the client IP.  @in contains the connection
  *		socket's descriptor.  Return non-zero to terminate
  *		the connection before sending or receiving anything.
  *		Because this happens immediately after the network connection
diff --git a/lib/server.c b/lib/server.c
index 44e62225bab9a14b7cd96d885e16519501268c73..ae580c8698b4a4b36bcc8cfb249696124073dba7 100644
--- a/lib/server.c
+++ b/lib/server.c
@@ -246,7 +246,7 @@ int lws_server_socket_service(struct libwebsocket_context *context,
 
 		if ((context->protocols[0].callback)(context, wsi,
 				LWS_CALLBACK_FILTER_NETWORK_CONNECTION,
-					   (void *)(long)accept_fd, NULL, 0)) {
+					   NULL, (void *)(long)accept_fd, 0)) {
 			lwsl_debug("Callback denied network connection\n");
 			compatible_close(accept_fd);
 			break;
diff --git a/test-server/test-server.c b/test-server/test-server.c
index 8ab4cb15a0893b93308ea3710f12f9d681209b59..ce2f61e3ed40f63ba3ec607c329981af3a41e274 100644
--- a/test-server/test-server.c
+++ b/test-server/test-server.c
@@ -246,7 +246,7 @@ bail:
 
 	case LWS_CALLBACK_FILTER_NETWORK_CONNECTION:
 #if 0
-		libwebsockets_get_peer_addresses(context, wsi, (int)(long)user, client_name,
+		libwebsockets_get_peer_addresses(context, wsi, (int)(long)in, client_name,
 			     sizeof(client_name), client_ip, sizeof(client_ip));
 
 		fprintf(stderr, "Received network connect from %s (%s)\n",