Re: raw packets

When you get the message that bytes have been written to the wire, this 
means that libnet_write() returned successfully which means the 
underlying call to sendto() returned successfully. Presumably this 
means a successful route table lookup and possible ARP query all went 
according to plan and the packet was successfully copied to the link 
layer for transmission. Skbuffs are linux only and it's been a looong 
time since I looked at any kernel internals actually but I assume the 
skbuff should be of type SOCK_RAW. That makes sense.

On May 23, 2004, at 9:32 PM, [email protected] wrote:

>
>
>
>
> Hi,
>
>       I had this doubt about raw packets :
>                               suppose I inject a raw packet into ip 
> using
> libnet_write, the packet was made using libnet_autobuild_ipv4. now 
> once I
> run that .out file, it says "written 20 bytes to the wire, check the 
> wire".
>      Whats does this mean, writing raw packets to the wire, 
> iirespective of
>    what that means, what actually happens (as far as i know) is that
>    writing raw packet cause the packet to be handed to ip, and not 
> directly
>    written to the wire (i.e not directly written to the ethernet 
> interface,
>    supposing the link level protocol is ethernet.). Now, my doubt is 
> what
>    path does this packet take?, once ip gets this packet a routing 
> decision
>    is made for this and depending on the routing decision the packet 
> either
>    goes out of the machine(to the wire) or to the applications, if it 
> was
>    meant for a particular application on the same machine. Am I right 
> here
>    ?
>      Also, when this packet is wriiten to IP the kernel surely 
> allocates an
>    skbuff, so what does skb->sock->type point to for such packets, 
> should
>    be SOCK_RAW for raw packets. Am i right ?
>
> Pls correct me if I am wrong.
>
> thanks
> Amit
>
>
> !DSPAM:40b221ab162262067215117!
>
>
--
Mike Schiffman, CISSP
http://www.packetfactory.net/schiffman
Doveryay No Proveryay