site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com On Aug 18, 2005, at 10:24 AM, Russell Seehafer (RIT Student) wrote: Regards.....Peter _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... I am writing a socket filter NKE that selectively swallows packets, sends information about that packet to a user process on the control socket, and waits for a response from the user process before deciding whether or not to re-inject the packet. The swallowing / re-injection happens on a per-socket basis. When I recieve certain sflt_event_t's (sock_evt_disconnecting, sock_evt_disconnected, and sock_evt_closing) I call a routine that drops all packets still queued on that socket. I call this routine when I am attached and detached from a socket as well. The app runs great for a period of time (I am able to selectively swallow and re- inject about 4,000 packets) but eventually I recieve the grey shutdown screen. I realize this could be due to a memory management problem somewhere in the nke, but I suspect that I am attempting to re-inject a packet on a socket that is not longer valid. My question is which of the sflt_event_t's tell me that a socket is no longer valid and that I should drop all of my remaining packets for that socket? Also, does the nature of this app raise any red flags, or bring to mind any key principals that I might be overlooking? Thanks for your help! -Russ Hi Russ, my first suspicion is that you're starving the kernel of mbufs by holding that many. Is there a way you can change so that you don't hold the mbufs, but copy the data? This email sent to site_archiver@lists.apple.com