On Saturday 2011-09-24 10:08, U.Mutlu wrote: >>> for example: >>> rv = recv(fd, buf, sizeof(buf), 0); // rv=84 >>> ... >>> ret = nfq_get_payload(tb,&data); // ret=40 (ie. ip + tcp pkt, both >>> w/o >>> options, and tcp w/o user data) >>> >>> So, here, what are the extra 44 bytes after the tcp data? >> >> I believe you will find there is a struct nlmsghdr at the beginning of the >> data, before the IP header > > nlmsghdr has size 16, I've not figured out yet what comes after it before the > (optional) payload starts. (It's struct nlmsghdr, struct nfgenmsg, struct nfqnl_msg_packet_hdr.) Suffice to say that, what buf actually contains is implementation-defined, and "uninteresting", since you chose to use a library to deal with it for you, abstracting the whole thing. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
