Hi all,
I have a simple question for people who has worked any time with PF_PACKET
without using libpcap to capture the packets (I also need sending over the
sockets, so it would not help me too much using libpcap).
After opening a PF_PACKET socket with no setsockopt or ioctl operations, I
get only 68 bytes for each packet (I do not use MSG_TRUNC int the recvfrom
call) and I do get the real size of each packet returned from the call.
I've looked over the libpcap sources and I've found that they state that
there is any problem with the kernel filter which always returns 68 bytes
by default.
Well, it looks true for me, I only get 68 bytes for each packet, but I want
the full one and I want to know if there is any easy way to tell it to the
kernel (just any setsockopt or ioctl to bypass the kernel filters).
If there is not such an option.. where should I touch (what kernel files
more or less) to implement this option ?
Thanks in advance
Sorry if this question was asked before here, but I did not found any other
place to ask this. Thaks for indulgence.
Un saludo:
Fernando Anton Alonso aka Mitra / Spanish Lords
|