On 7/31/20 8:57 AM, Eric Dumazet wrote:

On Thu, Jul 30, 2020 at 1:57 PM Martin KaFai Lau [off-list ref] wrote:

quoted

The TCP_SAVE_SYN has both the network header and tcp header.
The total length of the saved syn packet is currently stored in
the first 4 bytes (u32) of an array and the actual packet data is
stored after that.

A latter patch will add a bpf helper that allows to get the tcp header

s/latter/later/

Sorry, brain fart. I am using a different wording, that is all ;)