i am writing a netfilter module for linux 2.6.34.6-47 / 2.6.35. while i could capture the packets on the incoming hook since the same came as a single packet in probably the allocated skbuff area by the stack, i found that packets going out of the machine are getting splitted into linear and non-linear area. skb->data gives the total length of packet as correct, but when i extract skb-> data to print it, it prints only ip and tcp header. Now to treat the data i need to extract it and then push it back on the route.

To clarify if my data is 3 bytes . the total length by passing pointers is shown as 55 bytes = ( 52 byte of header + 3 byte of data), but i can't access these 3 bytes by using (skb->tail - skb->data), what i see is only header bytes. can some one please give some hint how to extract outgoing data for any further action and then put it back on route for further encapsulation by the L2 stack or whatever... where are those 3 bytes or application layer packets stored, how to access them to treat them before allowing them to go ahead in the route

will skb_linearize() or skb_linearize_cow() be of any use , if yes how and why. ?
thx in advance

What happen when you access 3 bytes by using skb->tail - skb->data?

You can access the application layer payload. then play around with it to your imagination. it could be 3 bytes or more or less. 3 byte was just used as example for easy understanding of the problem.