Get packet that's being routed

Question

I have a Linux box which is routing TCP/IP. I would like to see the contents of the packets that are being routed. I can do this with libpcap, but, I'm looking for a way which is simpler and better performance.

Is there any way to get a socket or any other type of interface into packets that are not for this host but are being routed by the host?

---

UPDATE:

1. I'd like to do this in C
2. If it's possible in user space, that's best. If I need to do this in kernel space, I'd consider it, but might opt to just do pcap instead.

Answer 1

You have three alternatives to libpcap

• Use packet sockets (AF_PACKET) in user space. http://man7.org/linux/man-pages/man7/packet.7.html
• Netfilter also allows you to handle pakcets in user space. http://www.netfilter.org/documentation/HOWTO/netfilter-hacking-HOWTO.html
• Hack the kernel but I think with the first two options this is not necessary