Resending to the list, since gmail only picks first responder :( >Are you saying the packets arrived before you put the socket into the sockmap? Yes, exactly! Could you elaborate on how BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB would be helpful? I assume I need to set up a sockops program and record passive ends pointers to bpf_sock somewhere, then redirect from passive to passive or passive->active? -- HisShadow