title: Netfilter kernel module to intercept packets and log them
body: <p>I had a basic code. This code drops and logs all the incoming and outgoing packets.
  I want to write a netfilter kernel module to intercept packets and log them in the kernel logs. It should be able to detect different(show 1 or 2 as example) kinds of TCP based reconnaissance packets. The module should detect these packets and log to kernel logs. I don't want to filter the packets, just identify and log them.</p>
  
  <pre><code>#include &lt;linux/kernel.h&gt;
  #include &lt;linux/module.h&gt;
  #include &lt;linux/netfilter.h&gt;
  #include &lt;linux/netfilter_ipv4.h&gt;
  
  static struct nf_hook_ops nfho;         //struct holding set of hook function options
  
  //function to be called by hook
  unsigned int hook_func(unsigned int hooknum, struct sk_buff **skb, const struct net_device *in, const struct net_device *out, int (*okfn)(struct sk_buff *))
  {
    printk(KERN_INFO "packet dropped\n");                                             //log to var/log/messages
    return NF_DROP;                                                                   //drops the packet
  }
  
  //Called when module loaded using 'insmod'
  int init_module()
  {
    nfho.hook = hook_func;                       //function to call when conditions below met
    nfho.hooknum = NF_IP_PRE_ROUTING;            //called right after packet recieved, first hook in Netfilter
    nfho.pf = PF_INET;                           //IPV4 packets
    nfho.priority = NF_IP_PRI_FIRST;             //set to highest priority over all other hook functions
    nf_register_hook(&amp;nfho);                     //register hook
  
    return 0;                                    //return 0 for success
  }
  
  //Called when module unloaded using 'rmmod'
  void cleanup_module()
  {
    nf_unregister_hook(&amp;nfho);                     //cleanup – unregister hook
  }
  </code></pre>