If I'm grabbing IP packets and looking at them very early on, before defragmentation has occurred, but I need to see the whole packet, how can I use IP defrag? Will it work if I get a packet that no socket is associated with? What are the return values of the function. In the Netfilter connection tracking module ip_conntrack_core.c, there is a ip_ct_gather_frags() function that returns NULL if all fragments aren'y ready yet and a new skbuff when they are. Does ip_defrag() work the same way? It seems to, but I'd like some verification before I screw something up. Also, from ip_conntrack_core.c in ip_ct_gather_frags() we have ... local_bh_disable(); skb = ip_defrag(skb); local_bh_enable(); Is there a good reason why we disable IRQ bottoms halves when calling this function? Thanks, Josh -- J S <webnews@comcast.net> - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html