Idea to think about: --salt 3b5b91c5a2 XOR client addresses for some more privacy the salt can be added e.g. when restarting router/iptables or may be generated for a particular host once. Purpose: hide MAC addresses behind the address mapping gateway Check compat with tcpdump. Linux2.4 needs to copy skb() for that, but it oopses Update csum, see http://www.faqs.org/rfcs/rfc1624.html for these protos (see http://www.firstpr.com.au/ip/ivip/checksums/ ): IPPROTO_TCP, IPPROTO_UDP, IPPROTO_DCCP, IPPROTO_AH?, IPPROTO_ICMPV6, IPPROTO_UDPLITE break NEXTHDR_NONE Evnt mit ipv6_gso_pull_exthdrs() oder ipv6_skip_exthdr() oder ipv6_find_hdr() oder nf_ct_ipv6_skip_exthdr() unsigned int ptr = skb_network_offset(skb) + sizeof(struct ipv6hdr); u_int8_t c = ipv6hdr.nexthdr; while (c != NEXTHDR_NONE && ip6t_ext_hdr(currenthdr)) { const struct ipv6_opt_hdr *hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr); switch(c) { case IPPROTO_FRAGMENT: hdrlen = 8; break; case IPPROTO_DSTOPTS: case IPPROTO_ROUTING: case IPPROTO_HOPOPTS: hdrlen = ipv6_optlen(hp); break; case IPPROTO_AH: hdrlen = (hp->hdrlen+2)<<2; break; default: return; } c = hp->nexthdr; ptr += hdrlen; }