you are right - these three seam to be my options ... I'm working on to man=
y=20
sites, I believe :-/ - sorry for my confusion

I think, I will implement the raw socket suggestion alternatively.

Thank you all - J=C3=B6rn

PS: If this stuff really get's into a stage of usability, I will let you kn=
ow

Am Donnerstag, 16. September 2004 01:33 schrieben Sie:
> It's not easy to see where you're heading...
> however, unless I'm missing something, you only have 3 ways:
>
> - use raw sockets as suggested by Ignatios. of course, you'll need as
> many sockets as protocols, but if you only need to handle a finite
> number of protocols, it's just a matter of programming.
>
> - use pcap as you did, and get rid of the error messages by:
>     * ignoring them:)
>     * droping the packets by ipf as ignatios said
>
> - modify the ip stack. this is only worth the pain if you can "justify"
> it, but it's not beyond reach.
>