RAW Socket - Ethertype和接收算法 - C.

Question

I'm working with raw socket in C language. I need to send and to receive a raw ethernet packet. The packet should start with an IEEE 802.3 header:

MAC DST [0-5] - MAC SRC [6-11] - ETH TYPE[12-13]

Catching the packets with wireshark I see the following structure:

MAC DST [0-5] - MAC SRC [6-11] - LENGTH[12-13] - TRAILER[14-58]-....

This is my code:

...
sraw = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_802_3));
...
retVal = setsockopt(sraw, SOL_SOCKET, SO_BINDTODEVICE, (void *)&ifr, sizeof(ifr));
...
val = 3;
retVal = setsockopt(sraw, SOL_SOCKET, SO_PRIORITY, &val, sizeof (val));
...
memcpy(ptr_eth_header->DstMac, dst_mac, 6);
memcpy(ptr_eth_header->SrcMac, src_mac, 6);
ptr_eth_header->Type = htons(ETH_P_802_3);
memcpy(buffer + ETHHDR_SIZE, data, 60);
...
sockaddr.sll_family = htons(PF_PACKET);
sockaddr.sll_protocol = htons(ETH_P_802_3);
sockaddr.sll_ifindex = ifr.ifr_ifru.ifru_ivalue;
sockaddr.sll_halen = 6;
memcpy(&(sockaddr.sll_addr), dst_mac, 6);
...
bytes = sendto(sraw, buffer, sizeof(buffer), 0, (struct sockaddr *) &(sockaddr), sizeof (struct sockaddr_ll));

Is it just a wireshark's "problem"? Any ideas?

My second problem is about the receipt of the raw messages. The process is stuck on the recvfrom.

This is my code:

sraw = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_802_3));
...
retVal = setsockopt(sraw, SOL_SOCKET, SO_BINDTODEVICE, (void *)&ifr, sizeof(ifr));
...
val = 3;
retVal = setsockopt(sraw, SOL_SOCKET, SO_PRIORITY, &val, sizeof (val));
...
val = CLIENT_PACKET_SIZE;
retVal = setsockopt(sraw, SOL_SOCKET, SO_RCVBUF, &val, sizeof (val));

sockaddr.sll_family    = htons(PF_PACKET);
sockaddr.sll_ifindex   = ifr.ifr_ifindex;
sockaddr.sll_protocol  = htons(ETH_P_802_3);

buffer = malloc(CLIENT_PACKET_SIZE * sizeof(char));
while (count < PACKET_COUNT) {
    bytes = recvfrom(sraw, buffer, CLIENT_PACKET_SIZE, 0, (struct sockaddr *)&sockaddr, (socklen_t*)sizeof(sockaddr));
    ...
}

Could you help me?

Thanks in advance!

Answer 1

I found the response about my first question: I use Ethertype == 0x0001 instead EtherType >= 0x0600

http://www.cavebear.com/archive/cavebear/Ethernet/type.html

What about the second question? What's wrong with my code?

Answer 2

A one word answer for your question is difficult. But if you ask me why the recvfrom could be stuck, with your code, i would say you may not be getting any packet satisfying your filter condition. Are you sure you are passing the ifindex value in the expected format? I see you pass the ifindex sockaddr.sll_ifindex = ifr.ifr_ifru.ifru_ivalue; like this in sendto.

Other reasons could be, the buffer size you set on the socket is unsupported by kernel or the kernel is running out of buffers and so many other reasons. but the chances of any of these are minimum.

Also, for your scenario, i would suggest using a non-blocking socket instead of blocking. Call the recvfrom only when you know there are packets waiting to be read.