If you only care about OS X, bpf(4) provides a very similar but nicer API for intercepting and sending raw packets. You could even go zero-copy without the he

If you only care about OS X, bpf(4) provides a very similar but nicer API for intercepting and sending raw packets. You could even go zero-copy without the hell that is Linux's 3 differently broken AF_PACKET mechanisms. I made a small example program[0] which just intercepts all packets and prints out statistics. The pthread stuff is only there to asynchroniusly handle signals without having to check every syscall for EINTR. Makes it possible to get statistics at run time by pressing control+T, however. [0] https://github.com/thasenpusch/bpf-example/blob/master/main.c https://github.com/thasenpusch/bpf-example/blob/master/main....