[Nhan Thanh Le <ltnhan@xxxxxxxxxx>]

Dear all,

   I am going to build a application network monitoring in real time. I 
have found out two ways to build it.

	1. We can virtual driver module hook to Netfilter running in kernel & 
use Netlink to communicate with user space application.
	2. Using pcap library to do it.

	But I could not make decision because I don't know which ways is the 
best way. Why we use it? Could someone help me to have decision or give 
me a comments. Thank you very much and appreciate for help.

Regards,
Nhanle