For portable programs it is suggested to use AF_PACKET via
pcap(3); although this covers only a subset of the AF_PACKET
features.
The SOCK_DGRAM packet sockets make no attempt to create or parse
the IEEE 802.2 LLC header for a IEEE 802.3 frame. When
ETH_P_802_3 is specified as protocol for sending the kernel
creates the 802.3 frame and fills out the length field; the user
has to supply the LLC header to get a fully conforming packet.
Incoming 802.3 packets are not multiplexed on the DSAP/SSAP
protocol fields; instead they are supplied to the user as
protocol ETH_P_802_2 with the LLC header prefixed. It is thus
not possible to bind to ETH_P_802_3; bind to ETH_P_802_2 instead
and do the protocol multiplex yourself. The default for sending
is the standard Ethernet DIX encapsulation with the protocol
filled in.
Packet sockets are not subject to the input or output firewall
chains.
Compatibility
In Linux 2.0, the only way to get a packet socket was with the
call:
socket(AF_INET, SOCK_PACKET, protocol)
This is still supported, but deprecated and strongly discouraged.
The main difference between the two methods is that SOCK_PACKET
uses the old struct sockaddr_pkt to specify an interface, which
doesn't provide physical-layer independence.
struct sockaddr_pkt {
unsigned short spkt_family;
unsigned char spkt_device[14];
unsigned short spkt_protocol;
};
spkt_family contains the device type, spkt_protocol is the IEEE
802.3 protocol type as defined in <sys/if_ether.h> and
spkt_device is the device name as a null-terminated string, for
example, eth0.
This structure is obsolete and should not be used in new code.
