Hi all, I was trying to understand how dev_add_pack() works : I created a sample driver, and added a packet handler like this : I declared global : struct packet_type my_pkt; Then from the module init I did : my_pkt.type = htons(ETH_P_ALL); my_pkt.dev = NULL; my_pkt.func = my_callback; my_pkt.data = NULL; my_pkt.next = NULL; dev_add_pack(&my_pkt); Now, from what I understand this function is called from /usr/src/linux/net/core/dev.c , dev_queue_xmit_nit() : The skb is cloned , and sent like this : skb2->h.raw = skb2->nh.raw; skb2->pkt_type = PACKET_OUTGOING; ptype->func(skb2, skb->dev, ptype); ...to each packet handler. What I do not understand so far is : 1) why I don't get only PACKET_OUTGOING skbs in my callback ? But also PACKET_HOST , PACKET_OTHERHOST and PACKET_BROADCAST ? 2) Can i stop a skb from being forwarded to the other protocol handlers, from my ETH_P_ALL handler ? I wonder if anyone can point me to some source that could explain the whole mechanism better. PS: I'm designing a module to "capture" the traffic from a real device and feed a virtual one , like such : Virt0: 192.168.1.1 | Eth1: 0.0.0.0 I would use the packet handler to capture all the traffic coming from eth1 and inject it in virt0: by changing the skb->dev And then calling netif_rx(). ( similarly to the VLAN driver ). But I guess I would have to stop that skb from being seen By other protocol handlers too ? Then the virtual device would change the skb->dev in start_hard_xmit() to the -real- device and use it for the transmission. So far I have a somewhat working prototype , but I am experiencing some strange behaviour so I went back to Understand better what dev_add_pack() is doing. For example , when I ping an host 192.168.1.2 I get a DUP In the answer : it seems that both interfaces, the real one and the virtual one, see the reply . Also Fragmentation does not work properly on the virtual interface. Thanks in advance, Enric -- Kernelnewbies: Help each other learn about the Linux kernel. Archive: http://mail.nl.linux.org/kernelnewbies/ FAQ: http://kernelnewbies.org/faq/