Hello again, im the insistent newbie :) Im trying to get packet pid (process identifier) but netfilter and nfnetlink functions aren't very clear: I saw a reference to packed pid in: struct nlmsghdr { __u32 nlmsg_len; /* Length of message including header */ __u16 nlmsg_type; /* Message content */ __u16 nlmsg_flags; /* Additional flags */ __u32 nlmsg_seq; /* Sequence number */ __u32 nlmsg_pid; /* Sending process port ID */ }; but isnt easy to get struct nlmsghdr from netfilter packet, i saw some could be but im not sure: extern struct nlmsghdr *nfnl_get_msg_first(struct nfnl_handle *h, const unsigned char *buf, size_t len); I don't know what is buf and len, i saw library code with ddd but description is very short and i dont know how can i get buf and what is exactly. Please someone can help me to get packet's pid? I tried using netstat (-ntap | grep sourceport and destination ip) but is too slow. Thanks for your time and sorry for my english. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html