Hi,

I was analyzing some tcpdump data, and noticed that it also captured packets mangled by Netfilter hooks.
Theoretically I know that the pcap library takes off the packets from ethernet driver level and with the help of
the dynamic filters set by userspace, we are able to see those packets via tcpdump.

But aren't netfilter hooks attached at a higher level, namely the network stack? If so, then how is the pcap library able to
sniff those packets as well? Is it like the pcap library just holds a reference to the packets it takes from the driver, or
does it maintain a separate copy for displaying?

Any answers/clarifications would be much appreciated.

Thanks,
Sowmya

=====-----=====-----=====
Notice: The information contained in this e-mail
message and/or attachments to it may contain 
confidential or privileged information. If you are 
not the intended recipient, any dissemination, use, 
review, distribution, printing or copying of the 
information contained in this e-mail message 
and/or attachments to it are strictly prohibited. If 
you have received this communication in error, 
please notify us by reply e-mail or telephone and 
immediately and permanently delete the message 
and any attachments. Thank you