Patent ID: 8848554

Claim:
A non-transitory computer-readable medium storing computer-executable instructions that when executed by a computer cause the computer to perform a method, the method comprising: selectively passing a network packet from an Internet Protocol kernel module to a filter upon determining that at least one filter hook is registered in the filter, wherein the Internet Protocol kernel module processes the network packet according to layer 3 Internet Protocol processing by using a plurality of layer 3 processes; selectively re-directing the network packet to a packet sniffer upon determining the packet is a member of a class of packets specified by the filter hook, wherein selectively re-directing the network packet occurs during layer 3 Internet Protocol processing of the network packet and occurs according to the filter hook that is inserted between the plurality of layer 3 processes in the Internet Protocol kernel module, wherein the plurality of layer 3 processes are processes for performing a plurality of different layer 3 services; copying the network packet into a buffer by the packet sniffer to store a duplicate copy of the network packet; and releasing the network packet for additional layer 3 processing, wherein the plurality of different layer 3 services include processes in addition to filtering, wherein releasing the network packet includes (i) sending the packet to the filter, and (ii) selectively providing the network packet to the Internet Protocol kernel module to resume processing upon determining there are no additional filter hooks registered in the filter.