Rawsock bpf mambo jambo?

[Alin-Adrian Anton]

DJF wrote:
> Hi everybody,
> 
> I've recently been looking into raw socket programming. However there's still a question that remains. Maybe it's just a case of RTFM, if so point me to a good manual on the topic. 
> The man pages indicate that you can do read and write operations with rawsock aswell as bpf. However, in all of the source codes I found, a raw socket was used to write to, and bpf was used to read from the interface.
> 

http://packetstorm.widexs.nl/programming-tutorials/indexdate.html

Search for "raw_tcp.tgz" in that page.

> What's the advantage in using the rawsock bpf combination instead of
> bpf (or raw socket) only?

Depends on what best fits your development circumstances.

The paper I co-authored uses bpf for reading, and socket for writing.

> 
> Thx in advance,
> 	dave
> 


-- 
Alin-Adrian Anton
GPG keyID 0x1E2FFF2E (2963 0C11 1AF1 96F6 0030 6EE9 D323 639D 1E2F FF2E)
gpg --keyserver pgp.mit.edu --recv-keys 1E2FFF2E

Never ask a man what OS he uses. If it's FreeBSD, he'll tell you.
If it's not, why embarrass him? ..I'm sorry..