3

AFAIK, arpd is used to offload certain jobs and memory footprint from kernel. The arpd process can get packets from two sockets:

  1. notification messages from kernel via NETLINK
  2. regular ARP packets such as ARP_REPLY from the host's neighbors, via a PF_PACKET socket.

My question is, how are ARP packets delivered to a userspace socket? When network stack receives an ARP packet, it passes it to arp_rcv() and arp_process() kernel functions, but I wasn't able to locate any code that sends packet to the PF_PACKET socket that arpd registered. I am sure I missed something here..

QnA
  • 1,035
  • 10
  • 25

0 Answers0