site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com User-agent: Microsoft-Entourage/10.1.4.030702.0 Being a newbie at kernel extensions myself, I am reluctant to suggest that I may have an answer but, what they hey, I'll take a chance at it. I also am doing a KEXT that inspects IP packets and converses with a daemon (a launch agent) via sockets. I do not have everything in place yet but mostly it is working. If you need to have a user app or daemon process a packet before it is sent up/down the IP stack then you will need to remove the packet from the IP stack in your kext input/output function (swallow the packet with a "return EJUSTRETURN") and send it to your user app via ctl_enqueuedata. Have your user app do it's thing at user speed and then send it back to your kext. The kext repackages it into an mbuf and injects it (ipf_inject_input or ipf_inject_output) back into the IP stack. This assumes that the packet is not a vital part of some important stream of packets and can be processed on its own. If it is part of a stream and order is important to the remote host then you will need to swallow all of them and inject them later to keep them in order. It is probably not a good idea to put the kernel to sleep. :-) Hope this is mostly correct and helps! -Allan _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... This email sent to site_archiver@lists.apple.com