Ethernet type 0x0101 not working with raw socket

Question

I tried to send a raw packet with ethernet type 0x0101 but it seems not to be working, if I use ethernet type 0x1000 it is working properly. Basically I open a raw socket:

int sd = socket(AF_PACKET, SOCK_RAW | SOCK_CLOEXEC, htons(0x0101));
int r = sendmsg(sd, msgSend, 0);

accordingly with iana ethernet type 0101-01FF are experimental, so to my understating can be used for experiments.

If I use 0x0101 tcpdump shows:

00:00:01.001914 aa:00:00:2e:00:02 > 08:00:27:0b:ed:84, 802.3, length 257: LLC, dsap Null (0x00) Individual, ssap Null (0x00) Command, ctrl 0x0000: Information, send s0
        0x0000:  0000 0000 efbe adde aaaa db00 0000 0000  ................                                                                                              
        0x0010:  0000 0000 0000 0000 0000 0000 0000 0000  ................                                                                                              
        0x0020:  0000 0000 0000 0000 0000 0000 0000 0000  ................                                                                                              
        0x0030:  0000

while when I use 0x1000 is shows:

00:00:00.439876 aa:00:00:2e:00:02 > 08:00:27:0b:ed:84, ethertype Trail (0x1000), length 64:                                                                            
        0x0000:  0000 0000 efbe adde aaaa db00 0000 0000  ................                                                                                              
        0x0010:  0000 0000 0000 0000 0000 0000 0000 0000  ................                                                                                              
        0x0020:  0000 0000 0000 0000 0000 0000 0000 0000  ................                                                                                              
        0x0030:  0000

What am I missing?

score 3 · Accepted Answer · answered Jul 04 '18 at 14:52

Tcpdump interprets the value 0x0101 in this position as Ethernet Frame Length.

Values smaller than 0x600 (1536 decimal) are assumed to be the frame length (parsed as Frametype IEEE 802.2 LLC) instead of the next protocol id (parsed as Frametype Ethernet II).

Here you see, that tcpdump indeed interprets 0x101 (257 decimal) as the length:

00:00:01.001914 aa:00:00:2e:00:02 > 08:00:27:0b:ed:84, 802.3, length 257: LLC, dsap Null (0x00) Individual, ssap Null (0x00) Command, ctrl 0x0000: Information, send s0

But your frame should be correctly on-wire as you intended it.

Ethernet type 0x0101 not working with raw socket

1 Answers1