Review your favorite Linux distribution.
Go Back > Forums > Non-*NIX Forums > Programming
User Name
Programming This forum is for all programming questions.
The question does not have to be directly related to Linux and any language is fair game.


  Search this Thread
Old 11-10-2004, 12:38 PM   #1
Registered: May 2004
Distribution: Gentoo, Debian, OpenBSD, NetBSD
Posts: 158

Rep: Reputation: 16
unbound PF_PACKET

I was wondering if anyone knows exactly where a recv called on an unbound PF_PACKET/SOCK_RAW socket comes in. Basically, I'm writing something that needs to do a bunch of stuff at a bunch of different levels. But I am also running it with SOCK_STREAM sockets bound to ports as well. Will this create race conditions?

My basic question is whether the data "recv"ed by the unbound PF_PACKET socket is data that is copied into those buffers, and the higher level SOCK_STREAM socket bound to some port or other also has a copy of that data in its buffers, or whether its a case of whichever "recv" gets called first, gets the data.

If its unfortunately the later case, is there anyway I can put data "recv"ed on the unbound PF_PACKET back onto the queue, or ignore it and leave it for the bound SOCK_STREAM socket?

I'm starting to think that maybe they do have seperate buffers and the PF_PACKET has its own copy. My reasoning for this is that, A, in the past this program has worked fairly well, and tcpdump has not reported TCP resends on the SOCK_STREAM port. This indicates to me that these packets are being received by that higher level socket, and dealt with appropriately and that the PF_PACKET socket can throw these away when it sees them. That's another question though. If I have this unbound PF_PACKET socket, the bound SOCK_STREAM socket, and then tcpdump running.. who gets what? Are they all given seperate copies of packets "bound" for them to work with? Or are they all taking things off a global queue and only tcpdump is actually (through its libpcap interface) handling these packets properly like a filter. Also, B, I tried using MSG_PEEK on the PF_PACKET recvs under the thought that this would leave the packets bound for other sockets on this imagined "global buffer". This created horrible problems and worked much worse (if at all) then just taking them off and chucking the ones unwanted.

Any knowledge someone could express with regards to the ordering of this packet capturing things would be quite helpful but please refrain from suggesting I use libpcap. ;-) I have in the past for other projects but I'm just not interested in the extra lib overhead for this application(i.e I want to do everything myself).

Last edited by Peterius; 11-10-2004 at 12:41 PM.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Chkrootkit : ppp0: not promisc and no PF_PACKET sockets tour Linux - Security 6 08-06-2004 12:48 PM
send eth pkt directly to datalink(PF_PACKET) milod Programming 6 10-29-2003 11:48 AM
send eth pkt directly to datalink(PF_PACKET) milod Linux - Networking 0 03-05-2003 09:13 AM > Forums > Non-*NIX Forums > Programming

All times are GMT -5. The time now is 06:42 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration