multiple readers for stack-processed net traffic

Hi, I'd like to be able to create a second "tap" for application data that presents data exactly as the application sees it, and in such a way that guarantees that both applications read the data before it is freed or acknowledged. I have skimmed the Coriolis book on the 2.0 IP stacks (yes, I know it's old), and it seems like the most direct way to do this is to alter tcp_recvmsg and udp_rcv, probably using an LKM. I have not given much thought yet about how this second application will indicate that it wants to snoop on given sockets, though. I was wondering if any of you kernel gurus have any suggestions on how to accomplish the above goals.

Thanks,
VaX#n8

Are you very sure you need this? I see heaps of issues. Why not do a userspace proxy? Even that would not be trivial btw, you'd need to buffer etc.

Regards,

bert

http://www.PowerDNS.com      Open source, database driven DNS Software 
http://lartc.org           Linux Advanced Routing & Traffic Control HOWTO