Table 1. Filter Memory Base Addresses
Family
Socket type
Protocol name
Memory starts with:
PF_PACKET
SOCK_RAW
Raw packet
Link layer header
PF_PACKET
SOCK_DGRAM
Packet
IP header
PF_INET
SOCK_RAW
Raw IP
IP header
PF_INET
SOCK_DGRAM
UDP
UDP header
PF_INET
SOCK_STREAM
TCP
TCP header