1 .\" This man page is Copyright (C) 1999 Andi Kleen <ak@muc.de>.
2 .\" Permission is granted to distribute possibly modified copies
3 .\" of this page provided the header is included verbatim,
4 .\" and in case of nontrivial modification author and date
5 .\" of the modification is added to the header.
6 .\" $Id: packet.7,v 1.13 2000/08/14 08:03:45 ak Exp $
7 .TH PACKET 7 1999-04-29 "Linux Man Page" "Linux Programmer's Manual"
9 packet, PF_PACKET \- packet interface on device level.
12 .B #include <sys/socket.h>
14 .B #include <netpacket/packet.h>
16 .B #include <net/ethernet.h> /* the L2 protocols */
18 .BI "packet_socket = socket(PF_PACKET, int " socket_type ", int "protocol );
21 Packet sockets are used to receive or send raw packets at the device driver
23 level. They allow the user to implement protocol modules in user space
24 on top of the physical layer.
30 for raw packets including the link level header or
32 for cooked packets with the link level header removed. The link level
33 header information is available in a common format in a
36 is the IEEE 802.3 protocol number in network order. See the
38 include file for a list of allowed protocols. When protocol
41 then all protocols are received.
42 All incoming packets of that protocol type will be passed to the packet
43 socket before they are passed to the protocols implemented in the kernel.
45 Only processes with effective uid 0 or the
47 capability may open packet sockets.
50 packets are passed to and from the device driver without any changes in
51 the packet data. When receiving a packet, the address is still parsed and
54 address structure. When transmitting a packet, the user supplied buffer
55 should contain the physical layer header. That packet is then
56 queued unmodified to the network driver of the interface defined by the
57 destination address. Some device drivers always add other headers.
59 is similar to but not compatible with the obsolete
64 operates on a slightly higher level. The physical header is removed before
65 the packet is passed to the user. Packets sent through a
67 packet socket get a suitable physical layer header based on the information
70 destination address before they are queued.
72 By default all packets of the specified protocol type
73 are passed to a packet socket. To only get packets from a specific interface
76 specifying an address in a
78 to bind the packet socket to an interface. Only the
82 address fields are used for purposes of binding.
86 operation is not supported on packet sockets.
94 the real length of the packet on the wire is always returned, even when it
95 is longer than the buffer.
98 The sockaddr_ll is a device independent physical layer address.
104 unsigned short sll_family; /* Always AF_PACKET */
105 unsigned short sll_protocol; /* Physical layer protocol */
106 int sll_ifindex; /* Interface number */
107 unsigned short sll_hatype; /* Header type */
108 unsigned char sll_pkttype; /* Packet type */
109 unsigned char sll_halen; /* Length of address */
110 unsigned char sll_addr[8]; /* Physical layer address */
117 is the standard ethernet protocol type in network order as defined
120 include file. It defaults to the socket's protocol.
122 is the interface index of the interface
125 0 matches any interface (only legal for binding).
127 is a ARP type as defined in the
131 contains the packet type. Valid types are
133 for a packet addressed to the local host,
135 for a physical layer broadcast packet,
137 for a packet sent to a physical layer multicast address,
139 for a packet to some other host that has been caught by a device driver
140 in promiscuous mode, and
142 for a packet originated from the local host that is looped back to a packet
143 socket. These types make only sense for receiving.
147 contain the physical layer (e.g. IEEE 802.3) address and its length. The
148 exact interpretation depends on the device.
150 When you send packets it is enough to specify
155 The other fields should be 0.
159 are set on received packets for your information.
167 Packet sockets can be used to configure physical layer multicasting
168 and promiscuous mode. It works by calling
170 on a packet socket for SOL_PACKET and one of the options
171 .B PACKET_ADD_MEMBERSHIP
173 .B PACKET_DROP_MEMBERSHIP
177 structure as argument:
184 int mr_ifindex; /* interface index */
185 unsigned short mr_type; /* action */
186 unsigned short mr_alen; /* address length */
187 unsigned char mr_address[8]; /* physical layer address */
194 contains the interface index for the interface whose status
198 parameter specifies which action to perform.
200 enables receiving all packets on a shared medium - often known as
201 ``promiscuous mode'',
202 .B PACKET_MR_MULTICAST
203 binds the socket to the physical layer multicast group specified in
208 .B PACKET_MR_ALLMULTI
209 sets the socket up to receive all multicast packets arriving at the interface.
211 In addition the traditional ioctls
215 can be used for the same purpose.
220 can be used to receive the time stamp of the last received packet. Argument
224 In addition all standard ioctls defined in
228 are valid on packet sockets.
231 Packet sockets do no error handling other than errors occurred while passing
232 the packet to the device driver. They don't have the concept of a pending
236 In Linux 2.0, the only way to get a packet socket was by calling
237 .BI "socket(PF_INET, SOCK_PACKET, " protocol )\fR.
238 This is still supported but strongly deprecated.
239 The main difference between the two methods is that
242 .B struct sockaddr_pkt
243 to specify an interface, which doesn't provide physical layer independence.
250 unsigned short spkt_family;
251 unsigned char spkt_device[14];
252 unsigned short spkt_protocol;
262 is the IEEE 802.3 protocol type as defined in
266 is the device name as a null terminated string, e.g. eth0.
268 This structure is obsolete and should not be used in new code.
271 For portable programs it is suggested to use
275 although this only covers a subset of the
281 packet sockets make no attempt to create or parse the IEEE 802.2 LLC header
282 for a IEEE 802.3 frame.
285 is specified as protocol for sending the kernel creates the
286 802.3 frame and fills out the length field; the user has to supply the LLC
287 header to get a fully conforming packet. Incoming 802.3 packets are not
288 multiplexed on the DSAP/SSAP protocol fields; instead they are supplied to the
291 with the LLC header prepended. It is thus not possible to bind to
295 instead and do the protocol multiplex yourself.
296 The default for sending is the standard Ethernet DIX
297 encapsulation with the protocol filled in.
299 Packet sockets are not subject to the input or output firewall chains.
308 No interface address passed.
312 Unknown device name or interface index specified in interface address.
316 Packet is bigger than interface MTU.
320 Not enough memory to allocate the packet.
324 User passed invalid memory address.
332 Interface address contained illegal interface index.
336 User has insufficient privileges to carry out this operation.
340 Unknown multicast group address passed.
346 In addition other errors may be generated by the low-level driver.
349 is a new feature in Linux 2.2. Earlier Linux versions supported only
353 glibc 2.1 does not have a define for
355 The suggested workaround is to use
359 #define SOL_PACKET 263
363 This is fixed in later glibc versions and also does not occur on libc5 systems.
365 The IEEE 802.2/803.3 LLC handling could be considered as a bug.
367 Socket filters are not documented.
371 recvmsg extension is an ugly hack and should be replaced by a control message.
372 There is currently no way to get the original destination address of
373 packets via SOCK_DGRAM.
377 .I <netpacket/packet.h>
378 is present since glibc2.1. Older systems need
381 .B #include <asm/types.h>
383 .B #include <linux/if_packet.h>
385 .B #include <linux/if_ether.h> /* The L2 protocols */
389 .\" This man page was written by Andi Kleen with help from Matthew Wilcox.
390 .\" PF_PACKET in Linux 2.2 was implemented
391 .\" by Alexey Kuznetsov, based on code by Alan Cox and others.
395 .BR capabilities (7),
400 RFC 894 for the standard IP Ethernet encapsulation.
402 RFC 1700 for the IEEE 802.3 IP encapsulation.
405 .I <linux/if_ether.h>
406 include file for physical layer protocols.