1. Florida State UniversityCOP5570 - Advanced Unix Programming Raw Sockets Datalink Access Chapters 25, 26

2. Florida State UniversityCOP5570 - Advanced Unix Programming What are Raw Sockets? Allows you to bypass the TCP/UDP layers. Send/receive your own packets, with your own headers. You need to do all protocol processing at user- level.

3. Florida State UniversityCOP5570 - Advanced Unix Programming Typical Uses ICMP messages –ping generates ICMP echo requests and received ICMP echo replies. Routing protocols –gated implements OSPF routing protocol. –Uses IP packets with protocol ID 89 – not supported by kernel. Writing your own protocols over IP

4. Florida State UniversityCOP5570 - Advanced Unix Programming Raw socket creation Only root can open a raw socket. sockfd = socket(AF_INET, SOCK_RAW, proto) where proto is IPPROTO_RAW, IPPROTO_ICMP etc.

5. Florida State UniversityCOP5570 - Advanced Unix Programming Raw socket output As usual – sendto(), sendmsg() etc. IP_HDRINCL option –Specifies whether the process or the kernel builds the IP header. /* allow process to build IP header */ int on=1; setsockopt( sockfd, IPPROTO_IP, IP_HDRINCL, &on, sizeof(on));

6. Florida State UniversityCOP5570 - Advanced Unix Programming Raw socket input Normally using recvfrom() Conditions for a packet to match raw socket –If protocol parameter was specified, only packets with that protocol value are delivered. –If bind() was called on raw socket, only packets destined to bound IP address are delivered. –If connect() was called, only packets from connected address are delivered.

7. Florida State UniversityCOP5570 - Advanced Unix Programming Which Protocol Types are Delivered? TCP and UDP never reach raw sockets –Kernel IP stack handles these –Linux implementation is an exception. All ICMP except –ICMP echo request –Timestamp request –Mask request All IGMP All other protocols that kernel doesn't understand –Such as OSPF

8. Florida State UniversityCOP5570 - Advanced Unix Programming Datalink Access Provides powerful access to packets at network device level. –Raw sockets only provide IP-level access Examples: –Tcpdump: Datalink acess + promiscuous mode settings –RARP implementation

9. Florida State UniversityCOP5570 - Advanced Unix Programming Methods for datalink access SOCK_PACKET interface - Linux –fd=socket(AF_INET, SOCK_PACKET, htons(ETH_P_ALL) ); –No kernel buffering/filtering. –High overhead, inefficient.