How to use a raw socket to listen only for wanted traffic?

Question

Three related questions:

1. Do raw sockets have any method of filtering equivalent to the in-kernel BPF (used by libpcap)?

2. Does opening a raw socket mean that it receives every IP packet on the machine?

3. How do iptables interact with raw sockets - does a raw socket see packets that iptables drops?

BPF - http://lwn.net/Articles/599755/

Answer 1

1. Do raw sockets have any method of filtering equivalent to the in-kernel BPF (used by libpcap)?

Well they do, and it's more than equivalent: they support BPF filters themselves. You would attach a socket like this:

 setsockopt(socket, SOL_SOCKET, SO_ATTACH_FILTER, &bpf_filter, sizeof(bpf_filter));

(There is a complete example in this question).

During the last few years BPF has undergone a lot of changes on Linux, and you can now attach it to a variety of hooks for networking: sockets, but also tc ingress/egress interfaces, XDP (on NICs with compatible drivers). Also: kprobes, tracepoints, perf events, cgroups, maybe more… for tracing/monitoring.

I am not sure enough to answer to questions 2 and 3, sorry.