I use libipq to get all package pass though my OUTPUT. iptables -A OUTPUT -p ip -j QUEUE but when I download a file with the size of 800M, I add all the user data length(computed by ntohs(iphdr->tot_len) - iphdr->ihl*4 - the header length of TCP). I find the user data length is quit smaller than that of the REAL file size. I don't know what 's the matter. I wonder whether I can't catch all the packages or I computer the data length wrong. Thanks! ___ Bert Zhang +86-0451-6413683 Information Retrieval Lab School of CS Harbin Institute of Technology P.R.C.
