Wow thanks, That diagram helped a bunch, over looked it. Now My program finds all the data necessary. Matt On Jun 24, 2004, at 10:43 AM, Peter Lovell wrote: On Jun 24, 2004, at 11:04 AM, Matthew Jaffa wrote: Hi, I have read chapter 2 about mbufs in TCP/IP books by Stevens. I am trying to get a little more understanding. My NKE is intercepting POST and GET Requests, normally these are within the range of 200 - 1500 in size so that it is easy to get all of the information from the mbuf by just doing char * data = mtod(mbuf,char*); But I now am dealing with POSTS that are huge, when I submit a huge POST form data is big. The first POST Request I intercept however is of the size > 2051, but when I look at outgoing traffic using ethereal each one is made sure to be split into chunks less than 2051, so how come the mbuf's m_pkthdr.len is greater then 2051 when it is only storing 2051, does this mean that there is another mbuf chained to it that I must then get the remaining data for that POST that has m_pkthdr.len > 2051? Thanks, Matt There's a big difference between m_pkthdr.len and m_len. Have a close look at the diagram on page 35 and it should help explain where the various bits of the packet are located. Regards.....Peter _______________________________________________ darwin-kernel mailing list | darwin-kernel@lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored. _______________________________________________ darwin-kernel mailing list | darwin-kernel@lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.