Search code examples
clinuxnetwork-programmingposixposix-api

C PF_PACKET Link-layer Processing

I'm trying to figure out the data structure that is stored in 'buffer' after the following:

sock=socket(PF_PACKET, SOCK_RAW, htons(ETHERTYPE_IP));

recvfrom(sock, buffer, 2048, 0, NULL, NULL);

I'd like to be able to poke into the data structure and read in the link-layer, IP layer, and TCP layer if it is a TCP packet. I tried the man pages, and some header files, but have it's just all over the place.

Thanks in advance.

Solution

  • I believe what you're after is the RFC that specifies how IP is encapsulated in Ethernet. Sadly that RFC is very thin, but a more recent RFC includes significantly more detail.