Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to develop an application (module or user-level if possible) to create a raw socket in RHEL stealing all level-2 packets directly from kernel (without being routed or handled by other open sockets). I would like to feed packets to pcap to programatically handle some packet types. What would be the best of doing it? I have seen articles on zero copy networking, pcap, BPF but I guess they are all working with packet captures/copies?

share|improve this question

closed as off topic by Mat, jasonwryan, Caleb, Renan, jw013 Nov 8 '12 at 17:00

Questions on Unix & Linux Stack Exchange are expected to relate to Unix or Linux within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

@Mat, for my education what exactly is off topic about that question? I'd agree it's poorly asked, but I can't see why it would be off-topic. – Stéphane Chazelas Nov 8 '12 at 22:26
up vote 2 down vote accepted

Don't give the interface an IP address. Just bring it up, and capture packets with libpcap. If it's got no IP address, the kernel will leave it alone if that's your concern.

If you want the interface to have an IP address handled by the kernel and redirect only some IP packets to your application, netfilter can do it. Look at the NFQUEUE or NFLOG iptables target.

If packet capture performance is your concern, look at PF_RING.

Otherwise, maybe you can explain in more detail what you're trying to do as it's unclear to me.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.