Hi, In 2.4.0, ip_finsih output is listed as: static inline int ip_finish_output2(struct sk_buff *skb) { struct dst_entry *dst = skb->dst; struct hh_cache *hh = dst->hh; #ifdef CONFIG_NETFILTER_DEBUG nf_debug_ip_finish_output2(skb); #endif /*CONFIG_NETFILTER_DEBUG*/ if (hh) { read_lock_bh(&hh->hh_lock); memcpy(skb->data - 16, hh->hh_data,16); read_unlock_bh(&hh->hh_lock); skb_push(skb, hh->hh_len); return hh->hh_output(skb); } else if (dst->neighbour) return dst->neighbour->output(skb); printk(KERN_DEBUG "khm\n"); kfree_skb(skb); return -EINVAL; } I guess its supposed to mean that if the hardware header is cached for the dst_entry, then copy 16 bytes of the header into the skb starting at skb->data - 16. So are we assuming that the header length is always 16? (magic number) And after that, we push skb->data back by hh->hh_len. Does this value equal 16? Either the data size used in skb_push should be 16, or the memcpy should use hh_len. Whats the purpose of doing it differently? TIA Akshay __________________________________________________ Do You Yahoo!? Get email at your own domain with Yahoo! Mail. http://personal.mail.yahoo.com/ - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org