>Alternatively, you can put the known sockets in the map from user >space and then monitor for new sockets with some tuple/key and >insert them based on whatever policy decides sockets need to >be redirected. I think that's what I did. I put socket fds into a normal HASH, with keys being localip localport remoteip remoteport for the other socket, then in verdict I looked up the value for that socket's key, and redirected based on that. But that's exactly when I encountered that problem. Or are you talking about something else?