diff --git a/os/net/ipv6/tcpip.c b/os/net/ipv6/tcpip.c
index 1ff760cff..52653b2a7 100644
--- a/os/net/ipv6/tcpip.c
+++ b/os/net/ipv6/tcpip.c
@@ -122,8 +122,15 @@ tcpip_output(const uip_lladdr_t *a)
 {
   int ret;
   if(NETSTACK_NETWORK.output != NULL) {
-    ret = NETSTACK_NETWORK.output((const linkaddr_t *) a);
-    return ret;
+    if(netstack_do_ip_callback(NETSTACK_IP_OUTPUT, (const linkaddr_t *)a) ==
+       NETSTACK_IP_PROCESS) {
+      ret = NETSTACK_NETWORK.output((const linkaddr_t *) a);
+      return ret;
+    } else {
+      /* Ok, ignore and drop... */
+      uip_clear_buf();
+      return 0;
+    }
   }
   LOG_INFO("output: NETSTACK_NETWORK needs to be set to an output function");
   return 0;
@@ -428,7 +435,11 @@ eventhandler(process_event_t ev, process_data_t data)
 void
 tcpip_input(void)
 {
-  process_post_synch(&tcpip_process, PACKET_INPUT, NULL);
+  printf("tcpip_input\n");
+  if(netstack_do_ip_callback(NETSTACK_IP_INPUT, NULL) ==
+     NETSTACK_IP_PROCESS) {
+    process_post_synch(&tcpip_process, PACKET_INPUT, NULL);
+  } /* else - do nothing and drop */
   uip_clear_buf();
 }
 /*---------------------------------------------------------------------------*/
diff --git a/os/net/ipv6/tcpip.h b/os/net/ipv6/tcpip.h
index feb06ff93..bf8c9b0b1 100644
--- a/os/net/ipv6/tcpip.h
+++ b/os/net/ipv6/tcpip.h
@@ -320,6 +320,7 @@ void tcpip_icmp6_call(uint8_t type);
  */
 CCIF extern process_event_t tcpip_event;
 
+
 /**
  * \name TCP/IP packet processing
  * @{
@@ -341,7 +342,6 @@ CCIF void tcpip_input(void);
  * The eventual parameter is the MAC address of the destination.
  */
 uint8_t tcpip_output(const uip_lladdr_t *);
-void tcpip_set_outputfunc(uint8_t (* f)(const uip_lladdr_t *));
 
 /**
  * \brief This function does address resolution and then calls tcpip_output
diff --git a/os/net/netstack.c b/os/net/netstack.c
index 1efd85570..a70090f2f 100644
--- a/os/net/netstack.c
+++ b/os/net/netstack.c
@@ -38,6 +38,50 @@
  */
 
 #include "net/netstack.h"
+#include "lib/list.h"
+
+/* The list of IP processors that will process IP packets before uip or after */
+LIST(ip_processor_list);
+
+/* Note: localdest is only used for the output callback */
+enum netstack_ip_action
+netstack_do_ip_callback(uint8_t type, const linkaddr_t *localdest)
+{
+  enum netstack_ip_action action = NETSTACK_IP_PROCESS;
+  struct netstack_ip_packet_processor *p;
+  for(p = list_head(ip_processor_list);
+      p != NULL;
+      p = list_item_next(p)) {
+    if(type == NETSTACK_IP_OUTPUT) {
+      if(p->process_output != NULL) {
+        action = p->process_output(localdest);
+      }
+    } else if(type == NETSTACK_IP_INPUT) {
+      if(p->process_input != NULL) {
+        action = p->process_input();
+      }
+    }
+    /* if not NETSTACK_IP_PROCESS - quit and return the desired action */
+    if(action != NETSTACK_IP_PROCESS)
+      return action;
+  }
+  return action;
+}
+/*---------------------------------------------------------------------------*/
+void
+netstack_ip_packet_processor_add(struct netstack_ip_packet_processor *p)
+{
+  if(p != NULL) {
+    list_add(ip_processor_list, p);
+  }
+}
+/*---------------------------------------------------------------------------*/
+void
+uip_ds6_ip_packet_processor_rm(struct netstack_ip_packet_processor *p)
+                               {
+  list_remove(ip_processor_list, p);
+}
+
 /*---------------------------------------------------------------------------*/
 void
 netstack_init(void)
diff --git a/os/net/netstack.h b/os/net/netstack.h
index fc0e92fd3..61249b5a4 100644
--- a/os/net/netstack.h
+++ b/os/net/netstack.h
@@ -113,7 +113,36 @@ extern const struct framer         NETSTACK_FRAMER;
 
 void netstack_init(void);
 
-/* Netstack sniffer */
+
+/* Netstack ip_packet_processor - for implementing packet filters, firewalls,
+   debuggin info, etc */
+
+enum netstack_ip_action {
+  NETSTACK_IP_PROCESS = 0, /* Default behaviour - nothing else */
+  NETSTACK_IP_DROP = 1, /* Drop this packet before processing/sending anymore */
+};
+
+enum netstack_ip_callback_type {
+  NETSTACK_IP_INPUT = 0,
+  NETSTACK_IP_OUTPUT = 1,
+};
+
+struct netstack_ip_packet_processor {
+  struct netstack_ip_packet_processor *next;
+  enum netstack_ip_action (* process_input)(void);
+  enum netstack_ip_action (* process_output)(const linkaddr_t *localdest);
+};
+
+/* This function is intended for the IP stack to call whenever input/output
+   callback needs to be called */
+enum netstack_ip_action netstack_do_ip_callback(uint8_t type, const linkaddr_t *localdest);
+
+void netstack_ip_packet_processor_add(struct netstack_ip_packet_processor *p);
+void netstack_ip_packet_processor_remove(struct netstack_ip_packet_processor *p);
+
+
+
+/* Netstack sniffer - this will soon be deprecated... */
 
 struct netstack_sniffer {
   struct netstack_sniffer *next;