Hi, I have a dlil filter, dynamic link layer nke. I am interested in getting the data out of the mbuf. I have isolated it down to a TCP header with flags SYN and ACK set, I am getting the header alright, but need to get the data of the TCP. in the mbuf m_next is not NULL so I go to that mbuf, and when I check the m_len of that mbuf, it says that it is > 256 which means it is in an external storage place. And according to the message header: struct m_hdr { struct mbuf *mh_next; /* next buffer in chain */ struct mbuf *mh_nextpkt; /* next chain in queue/record */ long mh_len; /* amount of data in this mbuf */ caddr_t mh_data; /* location of data */ short mh_type; /* type of data in this mbuf */ short mh_flags; /* flags; see below */ }; mh_data contains the location of the data, how do I use this variable to extract the data, and what do I store it in? char * ? I have been reading the TCP/IP vol. 2 book, it only says that is where the data is stored, but not how to extract it. Any help would be appreciated, Thanks, Matt _______________________________________________ darwin-kernel mailing list | darwin-kernel@lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.