Socket listening listening on both interfaces

Socket listening listening on both interfaces

[syedk]

Hi,
   i wrote a utility to capture packets on an interface using PF_PACKET
socket(on 2.4 kernel)

  int sock=socket(PF_PACKET,SOCK_RAW,htons(ETH_P_IP);

then i used ioctl to set the interface name for the socket:

   struct ifreq ifinfo;
   dev_name="eth1";
   strncpy(ifinfo.ifr_name,dev_name,strlen(dev_name));

  ioctl(sock,SIOCGIFFLAGS,&ifinfo);

But strangely i am able see packets from both eth0 and eth1 interfaces
present on my machine.Initially when i used eth0 it was ok.later when i
switched to eth1 then the socket is sniffing packets from both
interfaces.
How can the raw socket sniff packets from both eth1 and eth0 at the same
time even after i set interface name as either eth0 or eth1.
do i need to set somethings back to their original state before the
program terminates?

thanx in advance and regards
Syed SK

Re: Socket listening listening on both interfaces

[Glynn Clements]

syedk wrote:

>    i wrote a utility to capture packets on an interface using PF_PACKET
> socket(on 2.4 kernel)
> 
>   int sock=socket(PF_PACKET,SOCK_RAW,htons(ETH_P_IP);
> 
> then i used ioctl to set the interface name for the socket:
> 
>    struct ifreq ifinfo;
>    dev_name="eth1";
>    strncpy(ifinfo.ifr_name,dev_name,strlen(dev_name));
> 
>   ioctl(sock,SIOCGIFFLAGS,&ifinfo);

Huh? SIOCGIFFLAGS retrieves the flags for a specific interface, in
this case eth1.

> But strangely i am able see packets from both eth0 and eth1 interfaces
> present on my machine.Initially when i used eth0 it was ok.later when i
> switched to eth1 then the socket is sniffing packets from both
> interfaces.
> How can the raw socket sniff packets from both eth1 and eth0 at the same
> time even after i set interface name as either eth0 or eth1.
> do i need to set somethings back to their original state before the
> program terminates?

It sounds as if you want:

	char name[] = "eth1";
	setsockopt(sock SOL_SOCKET, SO_BINDTODEVICE, name, sizeof(name));

-- 
Glynn Clements <glynn.clements@virgin.net>

Re: Socket listening listening on both interfaces

[syedk]

my question is does'nt the ioctl call:
ioctl(sock,SIOCGIFFLAGS,&ifinfo);
bind the socket to eth1?
if it does'nt do  i need  to bind it using setsockopt?

thanks
syedk

On Wed, 2004-02-11 at 23:45, Glynn Clements wrote:
> 
> syedk wrote:
> 
> >    i wrote a utility to capture packets on an interface using PF_PACKET
> > socket(on 2.4 kernel)
> > 
> >   int sock=socket(PF_PACKET,SOCK_RAW,htons(ETH_P_IP);
> > 
> > then i used ioctl to set the interface name for the socket:
> > 
> >    struct ifreq ifinfo;
> >    dev_name="eth1";
> >    strncpy(ifinfo.ifr_name,dev_name,strlen(dev_name));
> > 
> >   ioctl(sock,SIOCGIFFLAGS,&ifinfo);
> 
> Huh? SIOCGIFFLAGS retrieves the flags for a specific interface, in
> this case eth1.
> 
> > But strangely i am able see packets from both eth0 and eth1 interfaces
> > present on my machine.Initially when i used eth0 it was ok.later when i
> > switched to eth1 then the socket is sniffing packets from both
> > interfaces.
> > How can the raw socket sniff packets from both eth1 and eth0 at the same
> > time even after i set interface name as either eth0 or eth1.
> > do i need to set somethings back to their original state before the
> > program terminates?
> 
> It sounds as if you want:
> 
> 	char name[] = "eth1";
> 	setsockopt(sock SOL_SOCKET, SO_BINDTODEVICE, name, sizeof(name));
> 
> -- 
> Glynn Clements <glynn.clements@virgin.net>

Re: Socket listening listening on both interfaces

[Glynn Clements]

syedk wrote:

> my question is does'nt the ioctl call:
> ioctl(sock,SIOCGIFFLAGS,&ifinfo);
> bind the socket to eth1?

No; it simply queries the flags for eth1.

> if it does'nt do  i need  to bind it using setsockopt?

Yes.

-- 
Glynn Clements <glynn.clements@virgin.net>