>The reason why I would like to do it as a kernel module is performance.
>Raw packets has to be filtered (by headers) and/or dumped to disk at
>rate close to gigabit per second. Also some of them must be send to
>userspace application.
>
>So my question remains open: how to implement such kernel module?
You are brave!
You, already have such a module on your system. It is the ETH driver.
Study it and modify as you wish.
Best,
/st
