packet(7) Miscellaneous Information Manual packet(7) packet - #include #include #include /* L2 */ packet_socket = socket(AF_PACKET, int socket_type, int protocol); ( OSI). . The socket_type is either SOCK_RAW for raw packets including the link-level header or SOCK_DGRAM for cooked packets with the link-level header removed. The link-level header information is available in a common format in a sockaddr_ll structure. protocol is the IEEE 802.3 protocol number in network byte order. See the include file for a list of allowed protocols. When protocol is set to htons(ETH_P_ALL), then all protocols are received. All incoming packets of that protocol type will be passed to the packet socket before they are passed to the protocols implemented in the kernel. If protocol is set to zero, no packets are received. bind(2) can optionally be called with a nonzero sll_protocol to start receiving packets for the protocols specified. CAP_NET_RAW , . SOCK_RAW - . , - sockaddr_ll. , . , . . SOCK_RAW , AF_INET/SOCK_PACKET Linux 2.0. SOCK_DGRAM . . , SOCK_DGRAM, sockaddr_ll. , . bind(2), struct sockaddr_ll . , : sll_family ( AF_PACKET), sll_protocol sll_ifindex. connect(2) . recvmsg(2), recv(2) recvfrom(2) MSG_TRUNC, , . sockaddr_ll . struct sockaddr_ll { unsigned short sll_family; /* AF_PACKET */ unsigned short sll_protocol; /* */ int sll_ifindex; /* */ unsigned short sll_hatype; /* ARP */ unsigned char sll_pkttype; /* */ unsigned char sll_halen; /* */ unsigned char sll_addr[8]; /* */ }; : sll_protocol is the standard ethernet protocol type in network byte order as defined in the include file. It defaults to the socket's protocol. sll_ifindex is the interface index of the interface (see netdevice(7)); 0 matches any interface (only permitted for binding). sll_hatype is an ARP type as defined in the include file. sll_pkttype contains the packet type. Valid types are PACKET_HOST for a packet addressed to the local host, PACKET_BROADCAST for a physical-layer broadcast packet, PACKET_MULTICAST for a packet sent to a physical-layer multicast address, PACKET_OTHERHOST for a packet to some other host that has been caught by a device driver in promiscuous mode, and PACKET_OUTGOING for a packet originating from the local host that is looped back to a packet socket. These types make sense only for receiving. sll_addr sll_halen contain the physical-layer (e.g., IEEE 802.3) address and its length. The exact interpretation depends on the device. , sll_family, sll_addr, sll_halen, sll_ifindex sll_protocol. 0. sll_hatype sll_pkttype . setsockopt(2) SOL_PACKET. PACKET_ADD_MEMBERSHIP PACKET_DROP_MEMBERSHIP . PACKET_ADD_MEMBERSHIP , PACKET_DROP_MEMBERSHIP . packet_mreq: struct packet_mreq { int mr_ifindex; /* */ unsigned short mr_type; /* */ unsigned short mr_alen; /* */ unsigned char mr_address[8]; /* - */ }; mr_ifindex , . mr_type . PACKET_MR_PROMISC ( << >>), PACKET_MR_MULTICAST , mr_address mr_alen, PACKET_MR_ALLMULTI , . , ioctl SIOCSIFFLAGS, SIOCADDMULTI, SIOCDELMULTI. PACKET_AUXDATA ( Linux 2.6.21) , recvmsg(2). cmsg(3). : struct tpacket_auxdata { __u32 tp_status; __u32 tp_len; /* packet length */ __u32 tp_snaplen; /* captured length */ __u16 tp_mac; __u16 tp_net; __u16 tp_vlan_tci; __u16 tp_vlan_tpid; /* Since Linux 3.14; earlier, these were unused padding bytes */ }; PACKET_FANOUT ( Linux 3.1) To scale processing across threads, packet sockets can form a fanout group. In this mode, each matching packet is enqueued onto only one socket in the group. A socket joins a fanout group by calling setsockopt(2) with level SOL_PACKET and option PACKET_FANOUT. Each network namespace can have up to 65536 independent groups. A socket selects a group by encoding the ID in the first 16 bits of the integer option value. The first packet socket to join a group implicitly creates it. To successfully join an existing group, subsequent packet sockets must have the same protocol, device settings, fanout mode, and flags (see below). Packet sockets can leave a fanout group only by closing the socket. The group is deleted when the last socket is closed. : o PACKET_FANOUT_HASH . , , , -- . o PACKET_FANOUT_LB . o PACKET_FANOUT_CPU , . o PACKET_FANOUT_ROLLOVER , , (backlogged). o PACKET_FANOUT_RND . o PACKET_FANOUT_QM (, Linux 3.14) queue_mapping skb. . IP , . PACKET_FANOUT_FLAG_DEFRAG, , . 16 . PACKET_FANOUT_FLAG_ROLLOVER : , . PACKET_LOSS ( PACKET_TX_RING) , tp_status TP_STATUS_WRONG_FORMAT . , . , tp_status TP_STATUS_SEND_REQUEST, send(2). , PACKET_LOSS, , tp_status TP_STATUS_AVAILABLE . PACKET_RESERVE ( PACKET_RX_RING) , . . PACKET_RX_RING . , ( tp_snaplen) . , tpacket_auxdata. . tp_net . -- SOCK_DGRAM, tp_mac. -- SOCK_RAW, . tp_status. tp_status TP_STATUS_KERNEL. , . tp_status, , TP_STATUS_USER, , . , tp_status TP_STATUS_KERNEL. Packet sockets implement multiple variants of the packet ring. The implementation details are described in Documentation/networking/packet_mmap.rst in the Linux kernel source tree. PACKET_STATISTICS struct tpacket_stats { unsigned int tp_packets; /* */ unsigned int tp_drops; /* - */ }; . TPACKET_V3, . PACKET_TIMESTAMP ( PACKET_RX_RING; Linux 2.6.36) The packet receive ring always stores a timestamp in the metadata header. By default, this is a software generated timestamp generated when the packet is copied into the ring. This integer option selects the type of timestamp. Besides the default, it support the two hardware formats described in Documentation/networking/timestamping.rst in the Linux kernel source tree. PACKET_TX_RING ( Linux 2.6.31) . PACKET_RX_RING . tp_status TP_STATUS_AVAILABLE tp_status TP_STATUS_SEND_REQUEST. , send(2) . buf len . sendto(2) sendmsg(2), . tp_status TP_STATUS_AVAILABLE. , PACKET_LOSS. PACKET_VERSION ( PACKET_RX_RING; Linux 2.6.27) , PACKET_RX_RING TPACKET_V1. , , . PACKET_QDISC_BYPASS ( Linux 3.14) By default, packets sent through packet sockets pass through the kernel's qdisc (traffic control) layer, which is fine for the vast majority of use cases. For traffic generator appliances using packet sockets that intend to brute-force flood the network--for example, to test devices under load in a similar fashion to pktgen--this layer can be bypassed by setting this integer option to 1. A side effect is that packet buffering in the qdisc layer is avoided, which will lead to increased drops when network device transmit queues are busy; therefore, use at your own risk. ioctl SIOCGSTAMP . struct timeval. , ioctl, netdevice(7) socket(7). , , . . EADDRNOTAVAIL . EFAULT . EINVAL . EMSGSIZE , MTU. ENETDOWN . ENOBUFS . ENODEV . ENOENT . ENOTCONN . ENXIO . EPERM . , . AF_PACKET Linux 2.2. Linux SOCK_PACKET. AF_PACKET pcap(3), AF_PACKET. SOCK_DGRAM IEEE 802.2 LLC IEEE 802.3. ETH_P_802_3, 802.3 ; LLC . 802.3 DSAP/SSAP; ETH_P_802_2 LLC. ETH_P_802_3; ETH_P_802_2 . , Ethernet DIX . (not subject) . Linux 2.0 : socket(AF_INET, SOCK_PACKET, protocol) , . -- SOCK_PACKET struct sockaddr_pkt, . struct sockaddr_pkt { unsigned short spkt_family; unsigned char spkt_device[14]; unsigned short spkt_protocol; }; spkt_family , spkt_protocol -- IEEE 802.3, , spkt_device -- null , , eth0. . LLC header handling IEEE 802.2/803.3 LLC . MSG_TRUNC issues MSG_TRUNC recvmsg(2) . SOCK_DGRAM. spkt_device device name truncation The spkt_device field of sockaddr_pkt has a size of 14 bytes, which is less than the constant IFNAMSIZ defined in which is 16 bytes and describes the system limit for a network interface name. This means the names of network devices longer than 14 bytes will be truncated to fit into spkt_device. All these lengths include the terminating null byte ('\0')). Issues from this with old code typically show up with very long interface names used by the Predictable Network Interface Names feature enabled by default in many modern Linux distributions. The preferred solution is to rewrite code to avoid SOCK_PACKET. Possible user solutions are to disable Predictable Network Interface Names or to rename the interface to a name of at most 13 bytes, for example using the ip(8) tool. Documentation issues . . socket(2), pcap(3), capabilities(7), ip(7), raw(7), socket(7), ip(8), RFC 894 IP Ethernet. RFC 1700 IP IEEE 802.3. . The Linux kernel source tree. Documentation/networking/filter.rst describes how to apply Berkeley Packet Filters to packet sockets. tools/testing/selftests/net/psock_tpacket.c contains example source code for all available versions of PACKET_RX_RING and PACKET_TX_RING. Alexey, Azamat Hackimov , kogamatranslator49 , Kogan, Max Is , Yuri Kozlov ; GNU 3 , . . , , . Linux man-pages 6.06 31 2023 . packet(7)