Question

i have made a module using hook function . its working but when i use ping google.com.i am getting 0045 as icmp type .But i think it should be 0 for echo reply. i had used following print command:

unsigned int hook_func(unsigned int hooknum, struct sk_buff *skb1, const struct net_device *in, const struct net_device *out, int (*okfn)(struct sk_buff *))
{
struct sk_buff *sock_buff;
 struct iphdr *ip1;
 struct icmphdr *icmp1;
 sock_buff = skb1;
//printk("ihere we are::%s,%d\n",__func__,__LINE__);
   ip1 = (struct iphdr *)skb_network_header(sock_buff);
 printk(KERN_ALERT"proto:%d\n",ip1->protocol);
if(ip1->protocol==1)
{
 icmp1 = (struct icmphdr *)skb_transport_header(sock_buff);
printk(KERN_ALERT"reply type: %04X,,seq : %04X\n",icmp1->type,icmp1->un.echo.id);
       }
// kfree(sock_buff);
return NF_ACCEPT;

  }

icmp1->type is __be16.

Answer 1

Replace icmp1 = (struct icmphdr *)skb_transport_header(sock_buff); with

icmp1 = (struct icmphdr *)(skb_transport_header(sock_buff) + ip_hdrlen(sock_buff));

icmpheader->type is an unsigned char, try

printk(KERN_ALERT"reply type: %u,,seq : %04X\n",icmp1->type,icmp1->un.echo.id);