Hi Redhatcc, Your question was understood, however for the example usage you gave DNS spoofing or a proxy server are both much better methods. If you want to intercept the packets and modify the data in real time i think you will find that substantially harder. For one each packet has a check sum to verify its not been tampered with which would be beyond most peoples skills to spoof. Far better would be acting as a man in the middle as either a router or a proxy. For example using something like squid 3 and an ICAP server you can rewrite webpages in real time so that, for example, all html tags defining the font colour for black are changed to pink, or all txt sitting between <p> tags is reversed. You could also use a url rewriter to redirect people to different parts of a site or different sites altogether. for example you can enforce google safesearch with a simple url rewrite that appends &safe=active to the end of your query string. both these methods are limited only by your own inventiveness. I saw one setup that processed the webpages via a filter to render them upside down as a joke on a wifi freeloader. I manage a substantial estate of proxy servers which is why i personally would use that method to intercept and modify traffic. but im sure that much of that can be accomplished by a router as well. Can you clarify what exactly would would like to accomplish by editing the raw tcp traffic?