how to capture ARP packets (among others) ?

From: Siddharth Jain (siddharthj_at_gmail.com)
Date: 08/30/05 

Date: 29 Aug 2005 15:56:32 -0700

Hi,

I am writing a simple application using the bsd socket api. I have 2
issues on which I could get no clarity even after obscene amounts of
googling. Here they are:

1. I capture TCP/IP,UDP/IP & ICMP/IP packets by making a RAW socket and
specifying the protocol as IPPROTO_TCP , IPPROTO_UDP & IPPROTO_ICMP
respectively.
In a similar way, how can I capture ARP packets? Do I have to make a
different type of socket for this?
btw...exactly which layer of the OSI model are we working on in case of
the above-mentioned sockets. I did find something to do with specifying
ETH_P_ARP as the protocol and PF_PACKET as the 1st parameter in
socket()...but I could harly understand it.

2. Is there a cleaner way in which I can make just 1 socket and capture
packets of all types on it and then open up the headers to recognize
what type of a packet it actually was?

Any help will be greatly appreciated.

Thanks in advance,
Siddharth Jain

Relevant Pages

  • Re: Socket is still connected after Server-Side socket termination.
    ... the socket. ... Keep in mind TCP/IP does not send polling packets when ... use Wireshark or other protocol sniffer ... to watch packets during an close on some socket you consider to behave ...
    (comp.lang.java.programmer)
  • Re: Problem with writing fast UDP server
    ... UDP packets per second. ... socket and threads. ... I wrote a simple case test: client and server. ... The maximum theoretical limit is 14,880 frames per ...
    (comp.lang.python)
  • RE: *warning* student question
    ... What option is this supposed CRC or hash supposed to be? ... >their shell session you're taking over their network socket. ... Systems will also drop TCP packets with bad checksums. ... We provide Ethical Hacking, Advanced Ethical Hacking, Intrusion ...
    (Security-Basics)
  • Re: [patch 4/10] s390: network driver.
    ... but it seems someone is complaining about some behavior changing? ... network driver discard packets on link-down. ... However this approach doesnt play well if the socket can ... be blocked completely because of /one/ interface having its link ...
    (Linux-Kernel)
  • Re: TCP Performance advice needed [long!]
    ... protocol, that expects a reply before sending the next piece of data, will ... always be completely dependent upon roundtrip times for its throughput - ... data in packets and to piggyback ACKs to replies. ... on the socket and it should go away. ...
    (freebsd-net)