Rawsock bpf mambo jambo?

[Alin-Adrian Anton]

And as it has already been said, BPF looks at a lower level than raw 
sockets.

With raw sockets, you are still bound to using IP packets (even if you 
intentionally create bogus ones). They will be encapsulated in ethernet 
packets, when the link goes out via ethernet.

BPF can be used to read/write ethernet packets too, for example, while 
raw_sockets cannot.

-- 
Alin-Adrian Anton
GPG keyID 0x1E2FFF2E (2963 0C11 1AF1 96F6 0030 6EE9 D323 639D 1E2F FF2E)
gpg --keyserver pgp.mit.edu --recv-keys 1E2FFF2E

Never ask a man what OS he uses. If it's a BSD, he'll tell you.
If it's not, why embarrass him? ..I'm sorry..