divert sockets and ethernet header

Y

yavuzg

Hi all,

Man page of divert says that "Divert sockets are similar to raw IP sockets, except that they can be bound to a specific divert port via the bind(2) system call". But I think there is one more difference between divert sockets and raw sockets. When I use divert socket I get an IP packet, ethernet header is stripped off.

I use below rule in ipfw.
Code: 
divert 5000 ip from any to any dst-port 2000 in

Is it possible to get entire packet (in or out) via divert sockets?

I read the man page of ipfw, packet flow part seems relevant. But I couldn't divert packets from lower layers (with ethernet header) but couldn't achieve.

thanks in advance,
yavuz
 
If I understand correctly the divert socket mechanics are based around bind syscall making ethernet headers irrelevant to your program as your filter is based around IP protocol and filtered by port(s) and IP hosts. If you want to get to lower layers I think its much more simple to use bpf(4) handle the raw stream and filtering yourself in userland rather than by ipfw kernel module.
 
You must log in or register to reply here.
Back
Top