Hi, > The linux skbuff structure has an unsigned char *data. I believe that > it points to the actual data. Yes, u r right. > What data is this? Is this the data for the network layer (ie could > point to the transport layer header which is data for IP layer)? or is > this the data for the transport layer? AFAIK, this pointer keeps on changing on each of the layer. The kernel would modify this pointer at each of the layers. ( Please confirm this ). > Also, what is the size of the unsigned char* data pointed to by this > field? Is the unsigned int len or unsigned int truesize or unsigned int data_len the > true lengths of this data? I guess, you are talking about the size of the data portion pointed by skbuff. In that case the length will be of type that is defined in the skbuff structure, the length field in the structure. ( In 2.2 kernel it is unsigned int ). Corrections are welcome. Thanks & Regards --vijayck -- Kernelnewbies: Help each other learn about the Linux kernel. Archive: http://mail.nl.linux.org/kernelnewbies/ FAQ: http://kernelnewbies.org/faq/