hi, i am trying to implement a new protocol for establishing tcp/ip between two computers through the parallel port. (some thing similar to plip). but unlike plip i am using my own link layer header (8 bytes), instead of the standard ethernet header plip is using. i am using tcpdump to see the packets that are transmitted.. but i can see garbage in the place where my header used to be (even the header length is different) .. everything else is ok. i am sure that the frame is setup right because, i can see that the header comes out right in the other system. so exactly when does tcpdump intercept the packets that are sent..and how..? john -- Kernelnewbies: Help each other learn about the Linux kernel. Archive: http://mail.nl.linux.org/kernelnewbies/ FAQ: http://kernelnewbies.org/faq/