Hi, I am using a protocol filter over a Socket Filter. I was using a socket filter, but decided to switch to a protocol filter. It picks up all outgoing traffic just fine, except for Classic traffic. I was trying to look at the SharedIP.KEXT to know where the packets go after being intercepted by the RAW socket filter, it looks like it is injecting the packet into a protocol, So why doesn't my Protocol filter below pick it up? here is some code: TAILQ_FOREACH(ifp, &ifnet, if_link) { printf("This is the name: %s, This is the number: %d \n",ifp->if_name, ifp->if_unit); if(( bcmp(ifp->if_name,"en",strlen(ifp->if_name))== 0) && (ifp->if_unit == 1) ) { sprintf(bsdName, "%s%d", ifp->if_name, ifp->if_unit); printf("Install filter on bsdname = %s\n", bsdName); if ((retval = dlil_find_dltag(ifp->if_family, ifp->if_unit, PF_INET, &ip_dltag)) == 0) { //newIPv4Filter = _MALLOC(sizeof(struct dlil_pr_flt_str),M_TEMP,M_WAITOK); // add this filter to the list so that you can free the mem later. ipv4Filter = (struct dlil_pr_flt_str) { bsdName,NULL, dlil_v4_outfltr, 0, 0, dlil_v4_detach }; retval = dlil_attach_protocol_filter(ip_dltag, &ipv4Filter, &ipv4ID, DLIL_LAST_FILTER); } } } Thanks _______________________________________________ darwin-kernel mailing list | darwin-kernel@lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.