I'm trying to capture raw ethernet packets into a user space program. Having read about the TAP/TUN capabilities of the kernel, I went on and created the following setup:
Two systems connected directly (crossover cable). I gave them a static IP and My code is ruining on the second unit,
it opens the device successfully (IFF_TAP is set), I can see that tap0 was created and then I'm staring to read from the file descriptor I got. at this point I'm sending pings from to and while I thought my code will get those ICMP bytes, It gets nothing.

Here are some code fragments, based example I've found:

/* Connect to the device */
  strcpy(tun_name, "tap0");
  tun_fd = tun_alloc(tun_name, IFF_TAP | IFF_NO_PI);  /* tapinterface */
  if(tun_fd < 0){

  /* Now read data coming from the kernel */
  while(1) {
    nread = read(tun_fd,buffer,sizeof(buffer));
    if(nread < 0) {

    /* Do whatever with the data */


the call to read() is blocked forever and there is no data.
However.. if set tap0 with an IP address (ex: I do get lots of packets arriving from the kernel, but not the ICMP packets from the other machine, moreover doing this cause the pinging unit to receive no response until I delete tap0, bridging the real (eth0) and tap0 didn't do the trick as well, What did I do wrong ?

Thanks, Eitan.

1 Answer 1


Your tap/tun interfaces act like new physical network interfaces, where the other end is connected to a particular program.

So there's no connection to existing physical network interfaces, like the one that is at one end of the crossover-cable.

In particular you can't use a tap/tun interface to somehow capture packets from this interface (despite the name "tap").

You can route packets to this new interface, or bridge it, but it still won't capture packets; it will only get packets that are forwarded to it on level 2 or level 3.

For capturing raw packets from existing interface, have a look at raw sockets and packet sockets.

  • Thanks , so if I add another virtual interface ( for ex. Tap0), it’s just the same as adding additional Nic? If so , settling this virtual interface along with an IP on the same network as the real Nic and then reading should let me “see” all the packets on that network ? Jun 13, 2019 at 16:33
  • (1) Yes. (2) You can't set it "on the same network", because what replaces the "network" if the tun/tap interface is the program at the other end. What you read in the program on the end of the tun/tap interface is all packets that go into that network interface; and this are different from packets that go into or come out of other network interfaces. In the same way, if you have two different LAN interfaces, the packets from one won't magically appear in the other one...
    – dirkt
    Jun 13, 2019 at 20:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .