Altering skb->protocol

[Neil Brewster]

Hello all...

I'm trying to write a new target to change the ethernet protocol ID of
a packet (let's just pretend there's a good reason for this...).

I've created the target extension, and within it I alter (*pskb)->protocol
from ETH_P_IP to something else, say ETH_P_ARP, and return IPT_CONTINUE.

I put a rule in the nat table, on the POSTROUTING hook, to jump to
this target - something like:
  iptables -t nat -A POSTROUTING -p icmp -j MYTARGET

I can see (via my debug output) that outgoing pings are getting their
skb-protocol altered by this target. However, it seems that something after
nat (i.e. after the packet leaves the ipv4 stack?) is changing this...
since tcpdump sees it as an ip packet (both on the send and receive sides).
Actually, I guess even the fact that the pings are getting responses verifies
that they are marked as IP when they go out.

Can anyone give me an idea of where this might be getting changed back to
ETH_P_IP? It was my understanding/hope that the device driver would use
skb->protocol to set up the ethernet header (and thus set
skb->mac.ethernet->h_proto to my altered protocol).

Thanks,
neil.