Re: [developer] Raw ethernet packets

[Marcel Telka <marcel@telka.sk>]

On Fri, May 31, 2024 at 11:51:42AM +0200, Marcel Telka wrote:
> On Fri, May 31, 2024 at 12:13:37PM +0300, Denis Kozadaev wrote:
> > witch% cat main.c 
> 
> [snip]
> 
> > This is my old code I played long time ago.
> > I hope this will help you...
> 
> Great!  The packet receive seems to works here,  I'm going to try
> sending soon.

Lesson learned: the sll_ifindex is not the same as index reported by
ifconfig -a :-).

Anyway, the sending still does not work.  All below pass (the send
returns 60), but no packet on the network (snooped on both sending host
and another host on the same LAN):


	char buf[] =
	"\xff\xff\xff\xff\xff\xff"
	"\x00\x1c\x25\xa0\xb7\x2e"
	"\x08\x06\x00\x01"
	"\x08\x00\x06\x04\x00\x01"
	"\x00\x1c\x25\xa0\xb7\x2e"
	"\x0a\x00\x00\x0d"
	"\xff\xff\xff\xff\xff\xff"
	"\x0a\x00\x00\x3d"
	"\x00\x00\x00\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00"
	;

	s = socket(AF_PACKET, SOCK_RAW, 0);

	struct lifreq lifr;
	strcpy(lifr.lifr_name, "e1000g0");
	ioctl(s, SIOCGLIFINDEX, &lifr);

	struct sockaddr_ll llp = {};
	llp.sll_family = AF_PACKET;
	llp.sll_protocol = 0;
	llp.sll_ifindex = lifr.lifr_index;

	bind(s, (struct sockaddr *)&llp, sizeof llp);

	send(s, buf, sizeof buf - 1, 0);

So this is basically the same outcome as with my bpf approach :-(.

I suspect there might be some packet filtering involved in kernel?  This
is mostly the default OpenIndiana installation (up-to-date) on real HW
(not a VM).


To check that there is really no packet on the network I started snoop
on another machine (a snoop machine).  When I try `ping 10.0.0.61` (on
machine 10.0.0.13) I see following (on the snoop machine):

ETHER:  ----- Ether Header -----
ETHER:  
ETHER:  Packet 24 arrived at 12:54:11.78570
ETHER:  Packet size = 60 bytes
ETHER:  Destination = ff:ff:ff:ff:ff:ff, (broadcast)
ETHER:  Source      = 0:1c:25:a0:b7:2e, 
ETHER:  Ethertype = 0806 (ARP)
ETHER:  
ARP:  ----- ARP/RARP Frame -----
ARP:  
ARP:  Hardware type = 1 (Ethernet (10Mb))
ARP:  Protocol type = 0800 (IP)
ARP:  Length of hardware address = 6 bytes
ARP:  Length of protocol address = 4 bytes
ARP:  Opcode 1 (ARP Request)
ARP:  Sender's hardware address = 0:1c:25:a0:b7:2e
ARP:  Sender's protocol address = 10.0.0.13, 10.0.0.13
ARP:  Target hardware address = ?
ARP:  Target protocol address = 10.0.0.61, 10.0.0.61
ARP:  


           0: ffff ffff ffff 001c 25a0 b72e 0806 0001    ........%.......
          16: 0800 0604 0001 001c 25a0 b72e 0a00 000d    ........%.......
          32: ffff ffff ffff 0a00 003d 0000 0000 0000    .........=......
          48: 0000 0000 0000 0000 0000 0000              ............

Please note the packet data (should be same as the buf above).
The IP address 10.0.0.61 does not exist on the network.

With this setup when I try the code above on machine 10.0.0.13 I see
nothing in the snoop output on the snoop machine.

Any suggestion where to look next?


Thank you.

-- 
+-------------------------------------------+
| Marcel Telka   e-mail:   marcel@telka.sk  |
|                homepage: http://telka.sk/ |
+-------------------------------------------+