From owner-freebsd-hackers@FreeBSD.ORG  Tue Feb  2 03:48:03 2010
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
Delivered-To: freebsd-hackers@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 1EC51106568D
	for <freebsd-hackers@freebsd.org>; Tue,  2 Feb 2010 03:48:03 +0000 (UTC)
	(envelope-from lstewart@freebsd.org)
Received: from lauren.room52.net (lauren.room52.net [210.50.193.198])
	by mx1.freebsd.org (Postfix) with ESMTP id D6DB58FC16
	for <freebsd-hackers@freebsd.org>; Tue,  2 Feb 2010 03:48:02 +0000 (UTC)
Received: from lstewart.caia.swin.edu.au (lstewart.caia.swin.edu.au
	[136.186.229.95])
	by lauren.room52.net (Postfix) with ESMTPSA id E69947E820;
	Tue,  2 Feb 2010 14:48:00 +1100 (EST)
Message-ID: <4B67A06D.10405@freebsd.org>
Date: Tue, 02 Feb 2010 14:47:57 +1100
From: Lawrence Stewart <lstewart@freebsd.org>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD amd64; en-US;
	rv:1.9.1.5) Gecko/20100105 Thunderbird/3.0
MIME-Version: 1.0
To: Lukasz Jaroszewski <lvj@nietykalni.org>
References: <3930e0781002010302r3758968cl5f010bd7a585cca4@mail.gmail.com>
In-Reply-To: <3930e0781002010302r3758968cl5f010bd7a585cca4@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: freebsd-hackers@freebsd.org
Subject: Re: PFIL: how to get tcp/ip fields from mbuf
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
	<freebsd-hackers.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>, 
	<mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
	<mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 02 Feb 2010 03:48:03 -0000

On 02/01/10 22:02, Lukasz Jaroszewski wrote:
> Hello,
> I am wondering about most elegant and proper way to get IP header
> fields from mbuf, using PFILs. I have read Murat Balaban paper on
> PFIL_HOOKS where I found some example function. Question is how can I
> access IP header field in such manner.
>
> static int
> hisar_chkinput(void *arg, struct mbuf **m, struct ifnet *ifp, int dir,
> struct inpcb *inp)
> {
>          in_bytes += (*m)->m_len;
>          return 0;
> }

I hacked on a tool that uses pfil hooks to do in-kernel TCP data 
gathering. Probably has some useful snippets for you to look at in 
addition to Robert's suggestion.

http://svn.freebsd.org/base/projects/tcp_ffcaia2008_head/sys/netinet/siftr.c

Cheers,
Lawrence