Unexpected behavior after altering inetsw[] switch table

[Shaun Colley]

Hi Max & group,

> As you can see in netinet/in_proto.c, tcp does not use pr_output, but
> calls
> tcp_output() directly where needed.  Depending on what you want to achive
> it
> might be enough to hack up tcp_usr_send() and replace tcp_usrreqs.pru_send
> instead.  Replaceing tcp_output() is not easily possible. You could start
> with telling us what you *really* want to do so we can point you to a
> workable option.

Right, I'll start by telling you what I'm actually trying to achieve. 
Everytime an IP datagram with a TCP header is sent, I want to mangle (i.e.
modify) part of the TCP packet and it's payload with 'random' data. 
Although this may sound a bit pointless, I want to do this to implement a
form of dumb fuzzing, which is a form of stress testing used a lot in
computer security.  Does that make a bit of sense?

So I was attempting to modify the pr_output hook for TCP (which I now know
isn't possible) and replace it with a ptr to my own hacked tcp_output
routine.

Can you see a way to do what I'm trying to achieve?

Cheers,
shaun