How can I get these packets in the user space application? Performance Issues?

Steven J Scott sjscott at
Thu Dec 9 16:38:52 CET 2004

I have a side question on this.  I have a kernel module that creates a 
netfilter hook that looks for packets with a certain source port, and then 
directs them to NF_QUEUE, and I have a user space application that receives the queued packets. 
Since I am only queuing packets I want to monitor/modify is my performance 
hit significant?  Or am I better off doing everything within the kernel 


Rockwell Automation / Advanced Technology
sjscott at
(This email was sent via Notes running on Linux)

"Maarten Wijnants" <maarten.wijnants at>
Sent by: netfilter-devel-bounces at
09/12/2004 07:24 AM

        To:     "Srinivas G." <srinivasg at>, "Henrik Nordstrom" 
<hno at>
        cc:     kung at, netfilter-devel at, "Mukund JB." 
<mukundjb at>, Diego Woitasen <diegows at>
        Subject:        Re: How can I get these packets in the user space application?

Hello Srinivas G,

> My doubt is: How the user application can get the packet from the 'hook'
> function? What APIs are used in the user space application to access the
> packet from the hook function?

I am trying to understand your current situation. So you have a kernel 
module that is subscribed to a certain netfilter hook and as a result 
receiving packets; and now you want to pass these packets from your kernel 

module to a userspace application? Is this correct?

If this is your current situation, you should issue a NF_QUEUE verdict for 

arriving packets in your kernel module to queue the packets to userspace. 
Subsequently, you will need to create a userspace application to receive 
queued packets and run it. You can use libipq to write a userspace 
application that will accept queued packets. See the man page of libipq 
more information on how to do this (the man page contains a fully working 

I hope this helps you. Regards,

More information about the netfilter-devel mailing list