Hmm, I see what the problem is. You are talking about implementing
packet accounting. I don't care about counting the packets; I'm
concerned about doing access control. I want to prevent unauthorized
users from making network connections to certain addresses or ports,
while still allowing access to other services. i.e., I might want to
make telnet, FTP, and other "interactive" services off-limits to
people whose real name I don't know, but allow anyone to use finger,
whois, and maybe even HTTP. This type of control really has to be
implemented in the kernel, since otherwise it can be broken if the
user writes their own program to make the appropriate system calls, or
uploads their own FTP/telnet client.
-Marc