The whole net code is highly optimized - in the sense that it is copied between different parts of the memory only twice - according to "Linux Network Internals" - all the way to userspace (correct? if i did not remember wrongly :-)). And if you want to intercept, many ways. One is to intercept right after the packets is received from the network card, which is the function net_rx_action(), and just before sending is net_tx_action(). Above that the packet will be reassembled/disassembled according to network protocols. Have fun. -- To unsubscribe from this list: send an email with "unsubscribe kernelnewbies" to ecartis@xxxxxxxxxxxx Please read the FAQ at http://kernelnewbies.org/FAQ