Problem is you don't know which recv() a packet is destined for until you actually receive it and can parse the header and apply all of the filtering rules. Bu

Problem is you don't know which recv() a packet is destined for until you actually receive it and can parse the header and apply all of the filtering rules. But what you describe is exactly how O_DIRECT achieves zero/copy for read/write. Of course, if you assume multiple receive queues that are programmable, you can short cut the netfilter code. That was roughly the idea behind VJ channels.