Issue
About Linux's packet sockets: in a packet socket (AF_PACKET), the application program implements the Ethernet header and IP header to create and send packets. So here is my question. I don't understand the necessity of socket address (sockaddr_ll) in this case. What is the difference from the Ethernet header? What exactly is the role of the socket address?
Solution
Just like sockaddr_in identifies an IP address and port, sockaddr_ll indentifies a link-layer address and protocol. In the case of raw AF_PACKET sockets, the term "address" might be confusing, since we aren't really talking about IP/MAC or whatever other address, but we are talking about an interface (e.g. a physical network device) and a protocol.
An Ethernet header contains metadata about the Ethernet frame, and indicates which protocol (EtherType field) is being encapsulated in the payload. A sockaddr_ll can be used to match or to identify a certain interface and protocol (fields .sll_ifindex and .sll_protocol):
- When a packet socket is bound to a
sockaddr_ll, it will only receive packets from the specified interface (.sll_ifindex) and of the specified protocol (.sll_protocol) determined by the kernel from the EtherType field of the Ethernet header. - When receiving (
recvfromorrecvmsg), asockaddr_llstructure, which identifies the interface on which the packet was received and the protocol, is populated by the kernel for the user. - When sending (
sendtoorsendmsg), asockaddr_llstructure is used to specify on which interface to send the packet and which protocol to set in the Ethernet header (EtherType field).
See also this interesting article which may help understand how AF_PACKET sockets work: Send an arbitrary Ethernet frame using an AF_PACKET socket in C.
Answered By - Marco Bonelli Answer Checked By - Gilberto Lyons (WPSolving Admin)