Obviously I'm doing something wrong...My UDP port numbers look all wrong (I took at them raw and ran them through ntohs to see if anything looked right) *They're a type __be16 -- which is network byte order?) BTW, the IP addresses look fine, I wrote my own inet_ntoa_r... I'm running wireshark alongside my module to see if I can get it to agree.. Here's my code: static unsigned int main_hook(unsigned int hooknum, struct sk_buff **skb, const struct net_device *in, const struct net_device *out, int (*okfn)(struct sk_buff*)) { struct sk_buff *sock_buff; struct udphdr *udp_header; struct iphdr *ip_header; char address1[20]; char address2[20]; sock_buff = *skb; if(!sock_buff) return NF_ACCEPT; ip_header = ip_hdr(sock_buff); if(ip_header->protocol != IPPROTO_UDP) return NF_ACCEPT; udp_header = udp_hdr(sock_buff); printk("udp source = %s dest %s\n", inet_ntoa_r(*(struct in_addr *) &ip_header->saddr, address1), inet_ntoa_r(*(struct in_addr *) &ip_header->daddr, address2)); printk("udp packet = source port = %d, dest port = %d\n",ntohs(udp_header->source), ntohs(udp_header->dest)); printk("no ntohs: udp packet = source port = %, dest port = %d\n",udp_header->source, udp_header->dest); return NF_ACCEPT; -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html