Kernel Packet filter and 68 bytes

[Fernando Anton <fernando.anton@xxxxxxxx>]

Hi all,

I have a simple question for people who has worked any time with PF_PACKET 
without using libpcap to capture the packets (I also need sending over the 
sockets, so it would not help me too much using libpcap).

After opening a PF_PACKET socket with no setsockopt or ioctl operations, I 
get only 68 bytes for each packet (I do not use MSG_TRUNC int the recvfrom 
call) and I do get the real size of each packet returned from the call.
I've looked over the libpcap sources and I've found that they state that 
there is any problem with the kernel filter which always returns 68 bytes 
by default.
Well, it looks true for me, I only get 68 bytes for each packet, but I want 
the full one and I want to know if there is any easy way to tell it to the 
kernel (just any setsockopt or ioctl to bypass the kernel filters).
If there is not such an option.. where should I touch (what kernel files 
more or less) to implement this option ?

Thanks in advance

Sorry if this question was asked before here, but I did not found any other 
place to ask this. Thaks for indulgence.



Un saludo:
Fernando Anton Alonso aka Mitra / Spanish Lords