how to correctly distinguish broadcast udp packets vs unicast (socket, pcap or bpf)?

[Nikolay Denev]

On Jul 4, 2012, at 6:08 PM, Budnev Vladimir wrote:

> Good day to all.
> 
> What is the correct way to distinguish udp packets that obtained by application and were send on 255.255.255.255 ip addr from those that were send to unicast ip?
> 
> Seems it is impossible with read/recvfrom so we'v made that with libpcap. It coul be done with directly bpf api without pcap wrapper but i'm not sure about how big pcap overhead is.
> 
> The questions is if we have about 1Gb incoming traffic and using pcap filter for specific port how big is impact of using pcap in such situation? Is it possbile to estimate? Target traffic is about 1Mbit and while testing CPU is about 1-2% but i'm not sure about all the conditions.
> 
> recfrom recieves all the data without loss in such condition, is it possible that pcap because of its filtering nature(i dont know in details how bpf is realized deep in kernel:( ) will add big overhead while listening?
> 
> 
> _______________________________________________
> freebsd-net at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe at freebsd.org"


If I'm understanding your question correctly you can lookup the ip(4) manual page :

     If the IP_RECVDSTADDR option is enabled on a SOCK_DGRAM socket, the recvmsg call will return the destination IP address for a UDP datagram.  The msg_control field in the msghdr structure points to a buffer
     that contains a cmsghdr structure followed by the IP address.  The cmsghdr fields have the following values:

You can use this in you application and get the destination address of the packets be it unicast IP or the broadcast address.