A kernel module to transparently detour packets coming from a NIC and TCP application. Is it possible to make it done? <p>Is it possible for a Linux kernel module to transparently detour the packet coming from upper layer (i.e. L2,L3) and NIC? For example, <strong>1)</strong> a packet arrives from a NIC, the module gets the packet (do some processing on it) and delivers back to tcp/ip stack or <strong>2)</strong> an app sends data, the module gets the packet (do some processing) and then, delivers the packet to an output NIC.</p> <p>It is not like a sniffer, in which a copy of the packet is captured while the actual packet flow continues. </p> <p>I thought on some possibilities to achieve my goal. I thought in registering a <strong>rx_handler</strong> in the kernel to get access to the incoming packets (coming from a NIC), but how to delivers back to the kernel stack? I mean, to allow the packet to follow the path that it should have taken without the module in the middle.</p> <p>Moreover, let's say an app is sending a packet through TCP protocol. How the module could detour the packet (to literally get the packet)? Is it possible? In order to send it out through the NIC, I think <strong>dev_queue_xmit()</strong> does the job, but I'm not sure.</p> <p>Does anyone know a possible solution? or any tips? </p> <p>Basically, I'd like to know if there is a possibility to put a kernel module between the NIC and the MAC layer.. or in the MAC layer to do what I want. In positive case, does anyone has any hint like main kernel functions to use for those purposes?</p> <p>Thanks in advance. </p>