本文共 5889 字，大约阅读时间需要 19 分钟。

Linux / Unix Command: packet

NAME

packet, PF_PACKET - packet interface on device level.

SYNOPSIS

#include 
   
    #include 
    
        /* for the glibc version number */#if __GLIBC__ >= 2 && __GLIBC_MINOR >= 1 #include 
     
      #include 
      
              /* the L2 protocols */#else#include 
       
        #include 
        
         #include 
         
           /* The L2 protocols */ #endifpacket_socket = socket(PF_PACKET, int socket_type, int protocol);
         
        
       
      
     
    
   

DESCRIPTION

Packet sockets are used to receive or send raw packets at the device driver (OSI Layer 2)level. They allow the user to implement protocol modules in user space on top of the physical layer.

Thesocket_typeis either SOCK_RAW for raw packets including the link level header orSOCK_DGRAMfor cooked packets with the link level header removed. The link levelheader information is available in a common format in asockaddr_ll.protocol is the IEEE 802.3 protocol number in network order. See the<linux/if_ether.h> include file for a list of allowed protocols. When protocol is set tohtons(ETH_P_ALL)then all protocols are received.All incoming packets of that protocol type will be passed to the packetsocket before they are passed to the protocols implemented in the kernel.

 Only processes with effective uid 0 or theCAP_NET_RAWcapability may open packet sockets.

SOCK_RAWpackets are passed to and from the device driver without any changes inthe packet data. When receiving a packet, the address is still parsed andpassed in a standardsockaddr_lladdress structure. When transmitting a packet, the user supplied buffershould contain the physical layer header. That packet is thenqueued unmodified to the network driver of the interface defined by thedestination address. Some device drivers always add other headers.SOCK_RAWis similar to but not compatible with the obsolete SOCK_PACKETof Linux 2.0.

SOCK_DGRAM operates on a slightly higher level. The physical header is removed beforethe packet is passed to the user. Packets sent through aSOCK_DGRAMpacket socket get a suitable physical layer header based on the informationin the sockaddr_ll destination address before they are queued.

By default all packets of the specified protocol typeare passed to a packet socket. To only get packets from a specific interfaceuse(2)specifying an address in astruct sockaddr_llto bind the packet socket to an interface. Only the sll_protocol and thesll_ifindexaddress fields are used for purposes of binding.

The(2)operation is not supported on packet sockets.

When theMSG_TRUNCflag is passed to(2),(2),(2)the real length of the packet on the wire is always returned, even when itis longer than the buffer.

ADDRESS TYPES

The sockaddr_ll is a device independent physical layer address.

struct sockaddr_ll {    unsigned short  sll_family;    /* Always AF_PACKET */    unsigned short  sll_protocol;  /* Physical layer protocol */    int             sll_ifindex;   /* Interface number */    unsigned short  sll_hatype;    /* Header type */    unsigned char   sll_pkttype;   /* Packet type */    unsigned char   sll_halen;     /* Length of address */     unsigned char   sll_addr[8];   /* Physical layer address */};

sll_protocol is the standard ethernet protocol type in network order as definedin thelinux/if_ether.hinclude file. It defaults to the socket's protocol.sll_ifindex is the interface index of the interface(see(7));0 matches any interface (only legal for binding).sll_hatype is a ARP type as defined in the linux/if_arp.hinclude file.sll_pkttype contains the packet type. Valid types arePACKET_HOSTfor a packet addressed to the local host,PACKET_BROADCASTfor a physical layer broadcast packet,PACKET_MULTICASTfor a packet sent to a physical layer multicast address,PACKET_OTHERHOSTfor a packet to some other host that has been caught by a device driverin promiscuous mode, andPACKET_OUTGOINGfor a packet originated from the local host that is looped back to a packetsocket. These types make only sense for receiving.sll_addrandsll_halencontain the physical layer (e.g. IEEE 802.3) address and its length. The exact interpretation depends on the device.

When you send packets it is enough to specifysll_family,sll_addr,sll_halen,sll_ifindex.The other fields should be 0.sll_hatypeandsll_pkttypeare set on received packets for your information.For bind onlysll_protocolandsll_ifindexare used.

SOCKET OPTIONS

Packet sockets can be used to configure physical layer multicasting and promiscuous mode. It works by calling (2)on a packet socket for SOL_PACKET and one of the options PACKET_ADD_MEMBERSHIP to add a binding or PACKET_DROP_MEMBERSHIPto drop it.They both expect a packet_mreqstructure as argument:

struct packet_mreq{    int             mr_ifindex;    /* interface index */    unsigned short  mr_type;       /* action */    unsigned short  mr_alen;       /* address length */    unsigned char   mr_address[8]; /* physical layer address */ };

mr_ifindexcontains the interface index for the interface whose statusshould be changed.Themr_typeparameter specifies which action to perform.PACKET_MR_PROMISCenables receiving all packets on a shared medium - often known as``promiscuous mode'',PACKET_MR_MULTICAST binds the socket to the physical layer multicast group specified inmr_addressandmr_alen,andPACKET_MR_ALLMULTIsets the socket up to receive all multicast packets arriving at the interface.

In addition the traditional ioctls SIOCSIFFLAGS,SIOCADDMULTI, SIOCDELMULTIcan be used for the same purpose.

IOCTLS

SIOCGSTAMPcan be used to receive the time stamp of the last received packet. Argumentis a struct timeval.

In addition all standard ioctls defined in(7)and(7)are valid on packet sockets.

ERROR HANDLING

Packet sockets do no error handling other than errors occurred while passingthe packet to the device driver. They don't have the concept of a pendingerror

====

http://linux.about.com/library/cmd/blcmdl7_packet.htm

转载地址：http://klbkb.baihongyu.com/