Joost Remijn
Thu, 25 Oct 2001 22:10:39 +0200 (CEST)


Did you modify the ip-header and tcp-header in your packet-data before
calling set_verdict? You also have to recalculate the checksums in both


On 25 Oct 2001, Crg wrote:

> Hi,
>     With libipq, if you modify a packet does it have to be the same size
> as the orginal packet?
>     I am calling ipq_set_verdict with the modified packet and the
> modified packet length, but when the packet is seen through a packet
> sniffer it contains the modfied packet up to the modifed packet size,
> and then the rest of the packet is the orignal data.
>    I've even hardcoded the modified packets size into ipq_set_verdict as
> say 40 to test it, and the packet size reported by the packet sniffer is
> 97, which I think is the orginal packet size.
> Cheers