On Linux (2.6.39 kernel), using raw sockets, I'm trying to receive all the multicast frames that are sent out by the system itself.
I created a raw socket socket(AF_PACKET, SOCK_RAW, htons(ETH_P_IP));
, and was reading the frames from the socket, throwing out frames that don't have destination address start with '01:00:5e'. I know there are better ways to latch on UDP, but I was playing around, and I noticed this particular problem, so below is the only scope of this question.
I could capture all the multicast packets flying around, except for the packets that are produced by the system where the program was running. The only way that I could make it start capturing system's own packets (along with packets coming to it) were to change the protocol
parameter in the socket()
call to htons(ETH_P_ALL)
. The packets that I captured that way still had type of 0x0800
which is ETH_P_IP
.
So I'm wondering about this - Is using ETH_P_ALL
the only way to capture outgoing frames same as incoming frames? Is there any other way to specify direction of the packets captured?
packet(7)
is bit vague on the subject, and only says:
All incoming packets of that protocol type will be passed to the packet socket before they are passed to the protocols implemented in the kernel.