tcp_header=(struct tcphdr *)(skbuff->data+(skbuff->nh.iph->ihl*4));
Means =>data_address + ipheader_length = tcp_header_address
How it's possible???

Well, let's take a closer look at each part of this statement:

(1) The first part says that you are assigning a value to a variable ("tcp_header"), and that the value which you're assigning is to be interpreted as "a pointer to a structure of type 'tcphdr.' "

(2) The remainder of the statement is the calculation of the address in question.

(3) We know that there must be a pointer-variable "skbuff," which points to a thing which contans (perhaps among other things) a pointer named "data" and a structure named "nh" which contains an element named "iph" which is, in turn, "a pointer to something (else)." Within that structure there's an element called "ihl." We're grabbing that value and multiplying it by 4, then adding it to the value of the "data" pointer.

(4) If it were me, I'd re-write that statement!

But yes... the statement could, and probably does, match your verbal description. If "data" is the location of the start of the buffer, and "nh.iph" points to some kind of table of offsets-and-lengths, then this rather tricky-to-understand statement is probably correct.

Personally, I like statements that are "abundantly clear." Modern compilers are great at generating good code... but "C" programmers are still accustomed to coding for compilers that needed a lot of help. I'd write one, or several, statements to calculate the address ... in a way that is "abundantly clear." The compiler will generate tight and efficient code regardless of how you write it.

I think your confusing yourself on the data part. what's stored in the skbuff->data section is normally a full packet including an outer layer that is for the link layer (like ethernet) so to get to the tcp packet you need to skip over the the encapsulating layers. The kernel has macros and functions to make it easier to access the various levels like ip_hdr() and skb_header_pointer().

But these macros are only for higher version. .. We have to use the above expressions for kernel versions 2.4 .

DEar estabroo

WHile i am using a pre-routing hook i can capture data by passing pointer shifted by 52 bytes ( ip + tcp), but while i am in a post routing hook i see the total length of packet as correct, but when i try to access the data the same way as i did in pre routing hook i don't get anything. where does the data sits while packet is going out of machine and how to access that area.
thx