Hooking Packets

• SteganRTP registers itself as a user-space queuing agent for NetFilter via libipq

• SteganRTP creates two rules in the NetFilter engine with targets of QUEUE:

• • Matching the Inbound RTP stream at PREROUTING
  • Matching the Outbound RTP stream at POSTROUTING

• SteganRTP is then able to:

• • Read packets from the queue
  • Modify them if needed
  • Place them back into the queue
  • Tell the queue to accept the packet for further routing