In the man pages it says that if you get a negative value then it is a failure , otherwise it is a sucess. The reason that you may get the packets dropped may be because you modified them in such a way that they are not valid anymore (you change thing to an invalid ip address or something like that) On how to get the packet info Once you get the packet = ipq_get_packet(buffer) you can access the packet data (including header and payload) from memory location packet +1, for example you can use something like usigned char *packet_all = (unsigned char *) (packet+1); then for example to access the ip_header length, which is located from bits 4-7 in the ip header you can use something like ip_header_len = (*packet_all & 0xF) * 4; // the 4 is since the header length is specified as a multiple of 32bits,ie 4 bytes or you can get the total length, which is the third and fourth bytes of the header as total_len = htons(*(unsigned short *) (packet_all + 2))) and so on, and based on the value of this ip header length and the data offset in the tcp header, (to find the data offset in the tcp header you can use something like tcp_header_len = ((*(packet_all + ip_header_len + 12 ) & 0xF0) >> 4 )* 4; // the 12 is because we have 2 bytes for source port + 2 bytes for destination port, 4 bytes for sequence number and 4 bytes for ack number in the tcp header before we reach the data offset so the data payload is from unsinged char *start = (packet_all + ip_header_len+ tcp_header_len) till unsinged char *end = start + total_len and I think you can just set the values of the packet, whether header or payload, once you got a pointer to it Jee J.Z. wrote: >Hi all, > >I am using the libipq library to do userspace programming on netfilter. I am >having some problems understanding the return values of the function >ipq_set_verdict(): > >When I set verdict (either NF_ACCEPT or NF_DROP) without modifying the >packet, the return value of ipq_set_verdict is 28 and everything works well; >however, when I set verdict trying to modify the packet, ipq_set_verdict >returns 88, and the packet seems always to be dropped even when I set >NF_ACCEPT. > >Does anybody know what these return values mean? Moreover, could anybody >tell me how I can successfully modify a packet using libipq? Thank you very >much in advance!! > >Regards, >Jee > > >
