Hi,
I'm having a devil of a time trying to bind a packet socket to a specific
interface.
Looking at the code in TCPDUMP was no help since it uses socket(PF_INET,
SOCK_PACKET, ...) and I (think) I want to
use socket(PF_PACKET, SOCK_RAW, ...) which is the newer idiom.
The problem is that if I do the bind, I never see any packets at all, even
though the bind returns success.
What I want to get is any and all ARP broadcasts directed at the given
interface. So, I'm doing:
struct sockaddr_ll inside_address;
fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ARP);
memset(&inside_address, 0, sizeof(inside_address));
inside_address.sll_family = AF_PACKET;
inside_address.sll_protocol = htons(ETH_P_ARP);
inside_address.sll_ifindex = 1; // desired
interface is eth1
inside_address.sll_hatype = ARPOP_REQUEST;
inside_address.sll_pkttype = PACKET_BROADCAST;
inside_address.sll_halen = 0;
if (bind(fd, struct sockaddr *) &inside_address,
sizeof(inside_address) != 0) {
// error
}
The bind returns success and I can use ioctl(fd, SIOCGIFHWADDR, &ifr) to
retrieve the MAC address of the
ethernet interface, so I'm pretty sure that worked and that I'm specifying
the itnerface correctly.
I suppose that leaves the sll_hatype and sll_protocol fields. Perhaps they
need to be byte-swapped differently.
Without the bind, my program sees traffic on all the interfaces and I only
want to see packets from one particular interface.
Any hints would be appreciated.
Mark Z.
-
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to [EMAIL PROTECTED]
