[SOLVED] Meaning and purpose of sockaddr_ll in packet sockets

Issue

About Linux's packet sockets: in a packet socket (AF_PACKET), the application program implements the Ethernet header and IP header to create and send packets. So here is my question. I don't understand the necessity of socket address (sockaddr_ll) in this case. What is the difference from the Ethernet header? What exactly is the role of the socket address?

Solution

Just like sockaddr_in identifies an IP address and port, sockaddr_ll indentifies a link-layer address and protocol. In the case of raw AF_PACKET sockets, the term "address" might be confusing, since we aren't really talking about IP/MAC or whatever other address, but we are talking about an interface (e.g. a physical network device) and a protocol.

An Ethernet header contains metadata about the Ethernet frame, and indicates which protocol (EtherType field) is being encapsulated in the payload. A sockaddr_ll can be used to match or to identify a certain interface and protocol (fields .sll_ifindex and .sll_protocol):

• When a packet socket is bound to a sockaddr_ll, it will only receive packets from the specified interface (.sll_ifindex) and of the specified protocol (.sll_protocol) determined by the kernel from the EtherType field of the Ethernet header.
• When receiving (recvfrom or recvmsg), a sockaddr_ll structure, which identifies the interface on which the packet was received and the protocol, is populated by the kernel for the user.
• When sending (sendto or sendmsg), a sockaddr_ll structure is used to specify on which interface to send the packet and which protocol to set in the Ethernet header (EtherType field).

---

See also this interesting article which may help understand how AF_PACKET sockets work: Send an arbitrary Ethernet frame using an AF_PACKET socket in C.

Answered By - Marco Bonelli

Answer Checked By - Gilberto Lyons (WPSolving Admin)