I catch network packet in /net/core/dev.c file at function __netif_receive_skb_core(). I parse the packet and fetch src_port, dest_port, etc. I have taken tcpdump at any interface. But port information of tcpdump does not match with my fetched port information. I don't understand why.
orig_dev = skb->dev;eth = eth_hdr(skb);__be16 src_port = 0, dest_port = 0; if (skb->protocol == htons(ETH_P_IP)){ ih = ip_hdr(skb); proto_num = ih->protocol; switch (ih->protocol) { case IPPROTO_TCP: { struct tcphdr *th = tcp_hdr(skb); src_port = th->source; dest_port = th->dest; break; } case IPPROTO_UDP: { struct udphdr *uh = udp_hdr(skb); src_port = uh->source; dest_port = uh->dest; break; } default: src_port = 0; dest_port = 0; } fast_node = NULL; fast_node = (struct fast_pktlist *)kzalloc(sizeof(*fast_node), GFP_KERNEL); if (fast_node) { fast_node->protocol_num = proto_num; strcpy(fast_node->in_interface, orig_dev->name); fast_node->orgsrc_ip = ih->saddr; fast_node->orgdest_ip = ih->daddr; memcpy(fast_node->orgsrc_mac, eth->h_source, 6); fast_node->org_srcport = src_port; fast_node->org_destport = dest_port; INIT_LIST_HEAD(&fast_node->_list); list_add_tail(&fast_node->_list, &FAST_HEAD); } else { printk("can not allocate memory at line number = %d\n", __LINE__); }}