1

Can a user application on macOS receive raw ethernet packets? I have a piece of hardware that uses it's own custom ethernet protocol and has it's own ether type defined. Is there anyway I can create a user application that sends / receives these packets? Mac OS does not support AF_PACKET. I believe Berkeley Packet Filter requires root access. Are there any other options?

Roland Rabien
  • 8,750
  • 7
  • 50
  • 67
  • I don't have a good answer for you but there may be a hint in the following from Wireshark download notes: "The installer package includes Wireshark, its related command line utilities, and a **launch daemon that adjusts capture permissions** at system startup". – Phillip Mills Feb 26 '18 at 20:04

2 Answers2

0

Install libpcap library - https://formulae.brew.sh/formula/libpcap Then you could sniff and/or inject arbitrary packets.

valenok
  • 827
  • 7
  • 9
0

Can a user application on macOS receive raw ethernet packets?

Yes. See, for example, /usr/sbin/tcpdump.

I believe Berkeley Packet Filter requires root access.

Yes, by default; that's what the "launch daemon that adjusts capture permissions at system startup" provided by Wireshark does (it's based on stuff from the libpcap source distribution) - it makes the BPF devices readable and writable by a group, so if your code runs with that group as one of the groups in its group set, it can read (capture) and write (transmit) on BPF devices.

Are there any other options?

PF_NDRV sockets might work. See, for example, this chapter from a macOS/iOS/etc. internal book and this StackOverflow answer.

Install libpcap library

Note that libpcap ships as part of macOS, and the headers ship as part of the macOS SDK, so that, on macOS, you can build programs that use it without installing anything other than Xcode (or the Xcode Command Line Tools), just as you can, on Linux, build programs that use libpcap without installing anything other than a compiler and your distribution's libpcap "developer package", and you can, on *BSD, build it without having installed anything other than whatever the installer says you need for developing software (it might even install the compiler/linker and the appropriate headers by default).

user16139739
  • 862
  • 3
  • 5