I'm working on a TCP/IP stack, that currently runs from Linux user space using raw sockets.

To test this, I need to disable the Linux Kernel TCP code for a specific port, so that the kernel doesn't screw with my implementation (eg. kernel responding to handshake).

I've referenced this, which says that raw sockets bypass netfilter, but during my testing, the packet is not received by the raw socket.

After more research I discovered that my AF_INET socket is still in the TCP/IP stack, however I do not want to implement Ethernet frames.

Is there anyway to disable the kernel processing on a specific port without using AF_PACKET?


I am creating my socket like so: socket(AF_INET, SOCK_RAW, IPPROTO_TCP). I then set HDRINCL: setsockopt(sockfd, IPPROTO_IP, IP_HDRINCL, &on, sizeof(on))

1 Answer 1


You can use the RAW table in IPTables to do this. Use a rule like:

iptables -t raw -A PREROUTING -p tcp --dport <your port> -j DROP

This should cause the kernel to ignore your packet, and it won't respond to the handshake.

  • Just tried it, my program still doesn't receive the packets. I added some additional information to my question to see if that has anything to do with it. Commented Oct 3, 2016 at 0:47
  • Based on your socket call, the iptables solution alone will not work, because it is telling the kernel to ignore the incoming packets on the port, so the kernel is not forwarding them to you. For what you're trying to do, you should probably look at the pcap library for reading from the socket, paired with the RAW table rule above to prevent the kernel from getting in your way. Commented Oct 3, 2016 at 1:42
  • Ok, I've switched to a socket created with AF_PACKET using SOCK_DGRAM. Packets are received through the iptables filter, but a simple SYN-ACK or even RST are not received by nmap, but are visible in Wireshark. Commented Oct 4, 2016 at 0:12
  • I'm not sure what you mean by "Packets are received through the iptables filter". The RAW table rule in iptables is making sure that the kernel, and particularly the normal TCP/IP stack, is not processing packets received on the port you specify. So there is no way you can use the socket system call to receive traffic. As you can see with Wireshark, the pcap library can see the reply, so you can use that to capture return traffic. This is how packet-manipulation packages like scapy work; you can send through a socket, but the receive needs to be separate, else the kernel interferes. Commented Oct 5, 2016 at 13:10
  • Were you able to solve this buddy? If yes some hints would be really helpful here
    – Skegg
    Commented Mar 18, 2018 at 12:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .