On Thursday, March 18, 2004, at 05:35 PM, Matt Jaffa wrote: Hi, I have a dlil filter, dynamic link layer nke. I am interested in getting the data out of the mbuf. The m_data field points to the beginning of valid data, and m_len tells you how much data from that point, *for this mbuf*, is valid. Note that I am using the "m_" fields, not the "mh_" fields. Always use the former, unless you have a *very* good reason not to. I have isolated it down to a TCP header with flags SYN and ACK set, I What is "it" that you have isolated? am getting the header alright, but need to get the data of the TCP. What is "the TCP"? in the mbuf m_next is not NULL so I go to that mbuf, Why don't you look in the current mbuf? Why go directly to the next one? and when I check the m_len of that mbuf, it says that it is > 256 which means it is in an external storage place. And according to the message header: NO! the value of the m_len field is *not* the indicator of "external" storage. If you make this assumption, you are making a critical error. The *only* valid indicator of external storage is the M_EXT bit in the m_flags field. mh_data contains the location of the data, Do *not* use 'mh_data' in your code. Use 'm_data'. how do I use this variable to extract the data, and what do I store it in? char * ? If you want to look at the data beginning at 'm_data', you need to use the 'mtod' macro. For example, assuming that the packet begins with a tcp header, you would use something like struct mbuf *mb = ...; struct tcphdr *tp = mtod(mb, struct tcphdr *); Be aware that this is only useful when the structure (or, in general, data) you want is at the beginning of the mbuf's data area. I have been reading the TCP/IP vol. 2 book, it only says that is where the data is stored, but not how to extract it. I am pretty sure that Stevens discusses this (say, at p. 46). In any case, since you have the address of the data, I don't understand how you can not know how to access it. What do you mean by "extract"? Regards, Justin -- /~\ The ASCII Justin C. Walker, Curmudgeon-at-Large \ / Ribbon Campaign X Help cure HTML Email / \ _______________________________________________ darwin-kernel mailing list | darwin-kernel@lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.