2

On Linux (2.6.39 kernel), using raw sockets, I'm trying to receive all the multicast frames that are sent out by the system itself.

I created a raw socket socket(AF_PACKET, SOCK_RAW, htons(ETH_P_IP));, and was reading the frames from the socket, throwing out frames that don't have destination address start with '01:00:5e'. I know there are better ways to latch on UDP, but I was playing around, and I noticed this particular problem, so below is the only scope of this question.

I could capture all the multicast packets flying around, except for the packets that are produced by the system where the program was running. The only way that I could make it start capturing system's own packets (along with packets coming to it) were to change the protocol parameter in the socket() call to htons(ETH_P_ALL). The packets that I captured that way still had type of 0x0800 which is ETH_P_IP.

So I'm wondering about this - Is using ETH_P_ALL the only way to capture outgoing frames same as incoming frames? Is there any other way to specify direction of the packets captured?

packet(7) is bit vague on the subject, and only says:

All incoming packets of that protocol type will be passed to the packet socket before they are passed to the protocols implemented in the kernel.

1 Answer 1

0

Use libpcap to capture all the incoming and outgoing packets and use pcap_setdirection() to specify a direction that packets will be captured. libpcap is faster then raw socket, as it uses PF_PACKET internally.

1
  • 1
    The last sentence makes no sense. PF_PACKET is the same thing as AF_PACKET which the asker is trying to use.
    – user253751
    Dec 21, 2018 at 2:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.