Re: Question about sniffers and linux

[Lanfranco Salinari]

----- Original Message -----
From: Abraham vd Merwe <[e-mail]>
To: salinarl <[e-mail]>
Cc: Linux Kernel Development <[e-mail]>
Sent: Monday, December 10, 2001 9:09 AM
Subject: Re: Question about sniffers and linux

>Hi salinarl!
>
>You don't need to write a kernel module to do this.
>
>Use RAW sockets. (See man 2 socket). If you're not interested in the link
>layer, you can also use DGRAM sockets to get everything from layer 3 and up
>(ip, arp, etc.)
>

Thank you for your answer, Abraham!
Perhaps I did not explain myself very well: I know about RAW sockets, but
the problem is that, for example, PPP headers are not passed to packet
sockets (for outgoing packets), because they are added inside the PPP driver
after the call to dev_queue_xmit_nit().
I don't know if this problem is typical of PPP, but it seems quite general,
to me. I think Ethernet headers are a special case, because they are taken
from a
cache and added in the IP layer, so they are visible to packet sockets.
Can someone please tell me if I'm wrong?
Best regards,

Lanfranco