PFIL: how to get tcp/ip fields from mbuf

[Lawrence Stewart]

On 02/01/10 22:02, Lukasz Jaroszewski wrote:
> Hello,
> I am wondering about most elegant and proper way to get IP header
> fields from mbuf, using PFILs. I have read Murat Balaban paper on
> PFIL_HOOKS where I found some example function. Question is how can I
> access IP header field in such manner.
>
> static int
> hisar_chkinput(void *arg, struct mbuf **m, struct ifnet *ifp, int dir,
> struct inpcb *inp)
> {
>          in_bytes += (*m)->m_len;
>          return 0;
> }

I hacked on a tool that uses pfil hooks to do in-kernel TCP data 
gathering. Probably has some useful snippets for you to look at in 
addition to Robert's suggestion.

http://svn.freebsd.org/base/projects/tcp_ffcaia2008_head/sys/netinet/siftr.c

Cheers,
Lawrence