Re: [developer] Raw ethernet packets

[Denis Kozadaev <denis@tambov.ru>]

The send() function can be used only when the socket is in a connected state.
(c) manual page at https://illumos.org/man/3SOCKET/send
Use sendto(), Marcel.

On Friday 31 May 2024 14:08:45 Marcel Telka wrote:
> On Fri, May 31, 2024 at 11:51:42AM +0200, Marcel Telka wrote:
[snip]

>         send(s, buf, sizeof buf - 1, 0);
>
> So this is basically the same outcome as with my bpf approach :-(.

>
> I suspect there might be some packet filtering involved in kernel?  This
> is mostly the default OpenIndiana installation (up-to-date) on real HW
> (not a VM).
>
>
> To check that there is really no packet on the network I started snoop
> on another machine (a snoop machine).  When I try `ping 10.0.0.61` (on
> machine 10.0.0.13) I see following (on the snoop machine):
>
> ETHER:  ----- Ether Header -----
> ETHER:
> ETHER:  Packet 24 arrived at 12:54:11.78570
> ETHER:  Packet size = 60 bytes
> ETHER:  Destination = ff:ff:ff:ff:ff:ff, (broadcast)
> ETHER:  Source      = 0:1c:25:a0:b7:2e,
> ETHER:  Ethertype = 0806 (ARP)
> ETHER:
> ARP:  ----- ARP/RARP Frame -----
> ARP:
> ARP:  Hardware type = 1 (Ethernet (10Mb))
> ARP:  Protocol type = 0800 (IP)
> ARP:  Length of hardware address = 6 bytes
> ARP:  Length of protocol address = 4 bytes
> ARP:  Opcode 1 (ARP Request)
> ARP:  Sender's hardware address = 0:1c:25:a0:b7:2e
> ARP:  Sender's protocol address = 10.0.0.13, 10.0.0.13
> ARP:  Target hardware address = ?
> ARP:  Target protocol address = 10.0.0.61, 10.0.0.61
> ARP:
>
>
>            0: ffff ffff ffff 001c 25a0 b72e 0806 0001    ........%.......
>           16: 0800 0604 0001 001c 25a0 b72e 0a00 000d    ........%.......
>           32: ffff ffff ffff 0a00 003d 0000 0000 0000    .........=......
>           48: 0000 0000 0000 0000 0000 0000              ............
>
> Please note the packet data (should be same as the buf above).
> The IP address 10.0.0.61 does not exist on the network.
>
> With this setup when I try the code above on machine 10.0.0.13 I see
> nothing in the snoop output on the snoop machine.
>
> Any suggestion where to look next?
>
>
> Thank you.