Hi, I am capturing packets in the Kernel using Netfilter hooks. So I get access to the packets as sk_buff structs. I want to access the IP data field. Could anyone please tell me what is exactly wrong with this math: ptr = sb->data+sb->nh.iph->ihl*4 Andif I want to find the length of the IP data field (when I've just captured packets thru the netfilter PRE_ROUTING hook ) what could be the length of this? For what fields should ntohs() be used to convert from NB to Host order? Now does ptr point to IP data (i.e. just past the IP header)? Any help will be appreciated! Thanks! -Rajat http://rajatswarup.blogspot.com/ -- Kernelnewbies: Help each other learn about the Linux kernel. Archive: http://mail.nl.linux.org/kernelnewbies/ FAQ: http://kernelnewbies.org/faq/