socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL) behaviour

[era_pk]

Dear All,

I am writing a small packet sniffing application to perform some operations. The following call

SOCKET_ID = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));

works fine on my Linux kernel 2.6.20 but it returns a negative value on Linux kernel 2.4.26.
I am running my application with root privileges.


Is PF_PACKET & SOCK_RAW available to kernel 2.6 or other kernel versions as well


Any ideas?

[backyes]

Maybe the AF_PACKET module is invalid.

[stevea]

This is from F13.
[root@nidula ~]# strace -f -etrace=socket /usr/sbin/tcpdump -i eth1
socket(PF_PACKET, SOCK_RAW, 768) = 3
socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 4
socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 4
....


So there is nothing wrong with socket(PF_PACKET, SOCK_RAW,...
and your third arg to socket looks correct.

Maybe it's time you checked the errno !

There is a chance that you need to deal with either SELinux or else the capabilities.
See pscap and getcap