The most common use for these modules is to provide for a multitude of device drivers without polluting the kernel proper. The above diagram shows a NIC driver loaded into the kernel. This is accomplished by a combination of overriding a few kernel functions which are exported to the NIC driver module, and overriding a few device methods used in the NIC driver module. To allow user processes access to the intercepted Ethernet frames, the module provides two pseudo-devices. Closed Device not in use, network flow undisturbed.
Network flow is undisturbed.
All received Ethernet frames are queued for subsequent reading, all written frames are transmitted to the kernel or NIC, depending on the device. It then sets both devices to Active mode using an ioctl. Doing so the process severs the connection between the Kernel network stack and the NIC driver. This graph interposes itself between the Kernel network stack and the NIC driver in the same manner explained in the previous section. A user process transmits data on an open TCP socket.