How to obtain process ID that created connection or owns one packet

[Marcus Sundberg]

Pablo Neira Ayuso wrote:
> Mikado wrote:
> 
>>Thanks all! Finally I found the answer in 'struct sk_buff':
>>
>>struct sk_buff ( #include <linux/skbuff.h> )
>>|_struct sock ( #include <net/sock.h> )
>>  |_struct socket ( #include <linux/net.h> )
>>    |_struct file ( #include <linux/fs.h> )
>>      |_struct fown_struct ( #include <linux/fs.h> )
>>        |_int pid
> 
> 
> Yes, but AFAIK you can only use that in the OUTPUT hook, not in the
> INPUT path.

...and if using SMP you can't use it at all in netfilter context.

//Marcus
-- 
---------------------------------------+--------------------------
   Marcus Sundberg <marcus at ingate.com>  | Firewalls with SIP & NAT
  Software Developer, Ingate Systems AB |  http://www.ingate.com/