Hello,
I have study the BPF, and I know it calls Socket Filtering in Linux.
(user)
|
(buffer)
|
(BPF) (origin protocol stack)
| |
(Data Link Layer)
Does the buffer above BPF is skb_buff?
If yes, origin protocol stack will get packet from it.
After the packet be processed, the packet in the buffer will be del.
Right? Thanks for your advise.