On 22/03/11 00:15, Sam Roberts wrote: > Obviously, there is no net device to pcap - I'm wondering if anybody > knows of ways to watch netlink traffic? I don't know netlink well, I'm > wondering if its possible to do a PF_NETLINK socket that promiscuously > receives all netlink traffic on all sockets? This, or any similar feature, does not exist yet. We can add some NETLINK_CONTROL family that would allows us to sniff all netlink traffic. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html