lkml.org 
[lkml]   [1998]   [Jan]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: sockets in SOCK_PACKET mode?
Date
longd writes:
> Please forgive if this is off topic, it seemed to me the folks on this
> list would know the most about this.
>
> I recently started playing with sockets into the interface packet layer,
> opened via a call something like this:
>
> s=socket(AF_INET,SOCK_PACKET,0);
>
> I learned about this type of socket through a small sniffer (linsniff.c).
> linsniff calls socket() like this:
>
> s=socket(AF_INET,SOCK_PACKET,htons(0x800));
>
> My question is, what is this magic number 0x800 for? I can't find it as a
> #define in any of the include files in the standard include tree. Is it
> necessary? In response to the inevitable question, yes, I am writing my
> own sniffer, simply because I want to play with packet-level sockets and I
> couldn't think of a better thing to do with them.

It's the Ethernet protocol id for IP. The constants are all of the
form ETH_P_FOO, defined in /usr/include/linux/if_ether.h. Use
ETH_P_ALL if you want to see every packet regardless of protocol.

--Malcolm

--
Malcolm Beattie <mbeattie@sable.ox.ac.uk>
Unix Systems Programmer
Oxford University Computing Services

\
 
 \ /
  Last update: 2005-03-22 13:41    [W:0.024 / U:1.024 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site