On Monday, December 9, 2002, at 03:11 PM, Eric Long wrote: Hi all, I've been camped out reading TCP/IP Illustrated volumes, trying to digest BSD networking. Vol. 2 is a pretty good reference, albeit for a much older version of the stack. I'm trying to write a kext to perform some manipulation of incoming data. At present, I am intercepting data in an sbappend hook. Concerning mbufs, if I want to remove bytes... If, for example, I have a chain of 3 mbufs and each has 50 bytes of data, If I want to remove bytes 30-39 of mbuf 2: Can I simply shift bytes 40-49 back by 10 bytes, shorten the mbuf's m_len by 10, and the packet header length by 10, and expect things to be "work"? What if I set the mbuf's m_len to 0? That should work, at least as far as the socket layer is concerned. Whether the 'user' of the socket likes it is another question. If you set an mbuf's m_len to zero, that should cause the system to skip over the mbuf in question. However, that depends on the last guy who touched the code being prepared for that eventuality. This is supposed to be a supported feature. If I want to insert bytes... How nasty is that to deal with? Can I insert safely from sbappend? This can be arbitrarily nasty. Depends on what you want to do, of course, but in full generality, inserting bytes is just ugly code, and you have to make sure you take care of a lot of edge conditions (see, e.g., above :-}). Not sure what you mean by 'safely', but you should be able to manipulate an mbuf chain there with impunity, assuming your code doesn't blow chunks. Does anyone know of code examples I might look at that show removing/inserting bytes into mbuf chains? I'm not aware of any that deals with the general case. Most code just chops data off or adds it at either end. There are some places (see 'SharedIP' in the repository) that do a little bit of this. I see mbuf.h seems to have all the functions for allocating/freeing mbufs, but I'm not certain about the big picture of how this is implemented. The Wright/Stevens book has a pretty good "big picture" description of the mbuf stuff. Seems like I may have some concerns about exceeding space available in the socket buffer. Yes and no. It may not be immediately obvious, but the socket buffer limit does not represent preallocated space. It is intended to limit both the total byte count and the total mbuf space that can be enqueued on a single socket buffer. This is designed to make sure that one or two of the socket buffers don't end up with all the mbufs in the system hanging on them. This means that it's not going to really screw up anything internally if you go over by a little bit, or you go over once in a while. Ignoring the limits in general, though, will cause you (or your customers) problems, so you should be very leery of messing with this for production operation. Regards, Justin -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | Men are from Earth. | Women are from Earth. | Deal with it. *--------------------------------------*-------------------------------* _______________________________________________ darwin-kernel mailing list | darwin-kernel@lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.