site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth; b=UZRrOghgYupB9+egspPTvD4sXXR77WWAWlVr2L78/H8SdiVWoOrDIqhUwCZkpgeXE8GqfxPGbYj8qUCvvnQ25+ZGQwPq8nuIFS0gP0abQsGcTIgZYzXt9QEHe2nH6qgoO8yeruEy4ahEnGjldOZ0UcbQW7VnErs9Xsr2NOOLd8w= On Jun 21, 2006, at 5:31 PM, Russell Seehafer (RIT Student) wrote:

I was wondering if there is a way to register a socket filter nke (such as the tcplognke sample) so that it is attached to both TCP and UDP sockets. Are there special values to specify for the domain, type, and protocol of the sflt_register function? Or, could it be possible to call sflt_register twice - once for udp and datagram sockets and once for stream and tcp sockets - from within the nke's start function? Any input would be greatly appreciated.

Thanks, Russ Hi Russ, you can do this without a lot of pain. Be sure you have a pointer struct and a separate signature for each, though. So it's one kext with a bunch of entry points, two structs and two signatures. You do call sflt_register twice within the start. In my usage, I also have separate signatures so that I can register for (and differentiate between) IPv4 and IPv6 calls, so I actually have <four>. Regards.....Peter

Thanks for your reply. I am a little confused by what you mean by the following: Be sure you have a pointer struct and a separate signature for each, though. So it's one kext with a bunch of entry points, two structs and two signatures. Are you speaking of the sflt_filter structure? Is it necessary to have a different structure with different function pointers for each registration? Thanks! Russ _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... On 6/21/06, Peter Lovell <vpndev@mac.com> wrote: This email sent to site_archiver@lists.apple.com