0

So I have two userspace applications (lets say app A and B) running on linux 2.6 kernel.

app A sends raw packet with a custom ethernet type (ETH_FOO) using the socket below

socket(PF_PACKET, SOCK_RAW, htons(ETH_FOO));

if app B opens a raw socket with ETH_P_ALL and listens to all interfaces without binding, it can successfully receive pkts sent by A with type ETH_FOO.

But if B opens the socket with type ETH_FOO, no packet is observed. I just want to capture ETH_FOO pkts. What may be the problem?

This is my first question here. Pardon my mistakes if there is any. Also I can not copy the entire code since it's not mine and somewhat propriatery.

Norbert
  • 2,741
  • 8
  • 56
  • 111
maed
  • 1
  • 1
  • just tried. No change. Strange thing is I can capture ETH_FOO packets from several different kernel modules, but not from my application – maed Sep 18 '16 at 18:43
  • What is the `ETH_FOO` value? – G. Emadi Sep 18 '16 at 18:46
  • Do you run your application with root privilege? Do you have error checking after system calls? – G. Emadi Sep 18 '16 at 18:51
  • ETH_FOO is 0x886c. yes error checking and root priviledges are ok. it just seems kernel doesn't like ETH_FOO pkts when I send them from a userspace app. I can capture same type of raw pkts with no problem when they are sent from a module. – maed Sep 18 '16 at 18:58

1 Answers1

1

When you use ETH_P_ALL, you are listening all packets, both ingoing and outgoing.

If you are in the same machine, using the same network interface, when you send a packet, there is no ingoing packet. Using ETH_P_ALL will get you the outgoing packet.

When you specify other value than ETH_P_ALL, only incoming packets are listened to. And you get nothing if using the Ethernet interface in the same machine.

You have two options here:

  • use different machines
  • in the same machine, use the loopback adapter (which creates an ingoing packet for every outgoing packet). The loopback adapter is listed together with the Ethernet adapter when you type ip a.

It took me some time to learn this, and I did it here, where you can learn a bit more.

Iñaki Idigoras
  • 21
  • 2