Hi Alan,
Firslty it is a pleasure communicating with you. There could be nobody else
more athoritative on this. I am novice , but i think AF_PACKET has been around
SOCK_STREAM and SOCK_DGRAM has been around for a long time..so could you tell
more specifically as to what type of socket has replaced SOCK_PACKET and what
i could use if i want to capture the whole frame right from the ethernet on.
Something like BPF filters that TCPDUMP uses.....i am looking at a similar
functionality ..Also you mentioned that the filtrs could be placed on any
socket which i understand but i was wondering if i could apply filters to say
(DHCP ports and stuff)
and recieve the whole frame(from ethernet on) at the application layer.
Thanks a lot.
-VJ
Alan Cox wrote:
> > ethernet and everything else) . But i recently read in a couple of man
> > pages and in documentation that SOCK PACKET is going to be obsoleted(
> > SOCK PACKET is what LPF uses..) .And there are places in the document
>
> It became AF_PACKET, SOCK_* and a whole proper socket family.
>
> > anything else that replaces the functionality of Linux Paket Filters and
> > the SOCK packets. Some man pages advice referring to packet(4) which is
> > a filter but is veryhigh level filter which filters on Broadcast or
> > multicast and all packets to the machine .I am looking for a mechanism
> > that replaces this SOCK packet with about the same amount of
> > functionality.
>
> The filters btw work on any kind of socket. You can even push them onto
> things like mailserver or webserver tcp sockets. Very handy for anti DoS
> handlers
