Consider a netfilter hook with NF_IP_PRI_FIRST, when I am looking the packet under my hook function n and hn always refer to the ip header event if its an icmp packet. For the nh I understand because its the network layer header but when using ICMP, why the transport layer header is pointing to an ip header and not an icmp header (i mean why ipiph is valid and not icmph)? TIA -- Kernelnewbies: Help each other learn about the Linux kernel. Archive: http://mail.nl.linux.org/kernelnewbies/ FAQ: http://kernelnewbies.org/faq/