I've written a module that steals packets at the net_bh (via proto handler) and hard_start_xmit points. I massage this data before injecting it back into the network. At the moment I'm testing this with ping. All works fine until packet sizes reach the MTU (1500, I'm on ethernet). At this point it appears that the fragmented echo reply packets are only getting a skb_headroom of 2 , where previously this was 16 when unfragmented, the echo reply fragments also appear to have grown larger than MTU (1514). I realise there are other mechanisms of achieving what I'm after, however they are both too high up the stack and lack efficient kernel<->userland transfers. Anyways I've been chasing this for a few days and wondered if anyone had some hints about what might be going wrong or at least where to look. Thanks, Richard. - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org