title: Rewriting network packets on the fly using libnetfilter_queue
body: <p>I am attempting to write a userspace application that can hook into an OS's network stack, sniff packets flying past and edit ones that its interested in.</p>
  
  <p>After much Googling, it appears to me that the simplest (yet reasonably robust) method of doing so (on any platform) is Linux's <a href="http://netfilter.org/projects/libnetfilter_queue/index.html"><code>libnetfilter_queue</code></a> project. However, I'm having trouble finding any reasonable documentation for the project, outside of the limited <a href="http://www.netfilter.org/projects/libnetfilter_queue/doxygen/index.html">official</a> documentation. Its main features (as stated by the first link are)</p>
  
  <ul>
  <li>receiving queued packets from the kernel nfnetlink_queue subsystem</li>
  <li>issuing verdicts and/or <strong>reinjecting altered packets</strong> to the kernel nfnetlink_queue subsystem</li>
  </ul>
  
  <p>Emphasis is my own. How exactly am I meant go about this? I've tried modifying the <a href="http://www.netfilter.org/projects/libnetfilter_queue/doxygen/nfqnl__test_8c_source.html">sample</a> code provided, but perhaps I am misunderstanding something. The code is operating in <code>NFQNL_COPY_PACKET</code> mode, so I <em>am</em> receiving the whole packet -- but my modifications to it seem to be restricted to my own application -- as one would expect, given the "copy" semantics.</p>
  
  <p>My feeling is that I am meant to make use of <code>NF_QUEUE</code> somehow, but I haven't quite grokked it. Any pointers?</p>
  
  <p>(If there is a simpler mechanism for doing this, which is also cross-platform, I'd love to hear about it!)</p>