jamie wrote: > the module's registered in init_module() like so: > > testhandler.dev = dev_get_by_name("eth0"); > testhandler.type = htons(ETH_P_ALL); > testhandler.func = handle_packet; > dev_add_pack(&testhandler); > > in handle_packet() i've tried various things e.g. kfree_skb, skb_dequeue, > skb_unlink, ... but the packet never gets dropped. when handle_packet() gets > the sk_buff it's cloned, is this causing problems with the dropping? I'm not very clueful about this code, but I believe all you are doing is registering as an input network tap (due to the ETH_P_ALL), and what that means is that you will only get a clone of the skb in question. What you do with your cloned skb doesnt affect the skb handed to the protocol handler for that protocol. Also, this is the input path, and you said you were interested in trapping packets in the output stream. (?) You seem to be saying your packets dont traverse the network TCP/IP stack, but come in below the IP layer (??). There currently arent any NF hooks below that level, but no reason (that I can think of) there couldnt be. i.e You can add a netfilter hook to say dev_queue_xmit(), and then fiddle with the packet. Or if possible, add hooks to the vmware handler itself. Alternatively, you could employ an appropriate queueing discipline. kfree_skb() would be sufficient. thanks, Nivedita - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html