Re: Socket type not supported..

[Gigi Sullivan <sullivan () seclab com>]

Good afternoon to all ;)))

On Tue, Jan 19, 1999 at 03:15:02PM +0100, Juan Cespedes wrote:
> On Tue, Jan 19, 1999 at 12:15:25AM +0100, Gigi Sullivan wrote:
> > Howdy to all ;)))
> >
> > On Mon, Jan 18, 1999 at 04:27:19PM +0100, Juan Cespedes wrote:
> > > On Fri, Jan 15, 1999 at 09:25:11PM +0100, Hroi Sigurdsson wrote:
> > > > SOCK_PACKET seems to have been completely deprecated in 2.2.0. There's
> > > > not even a mention of it in any of the toplevel files in /usr/src/linux.
> > > > So obviously nmap/libpcap-possibly-modified needs to be fixed? Will it
> > > > even be fixable when using the linux packet-filter?
> > >
> > >   I don't know what does libpcap do (I don't have it handy), but
> > > the correct way to open a socket for sending and receiving packets in
> > > linux-2.1.* and linux-2.2.* is to do
> > >           socket(PF_PACKET, SOCK_RAW, htons(0x0800))
> > > instead of
> > >           socket(PF_INET, SOCK_PACKET, htons(0x0800))
> > Sorry, but I don't agree w/ ya Juan.
> >
> > Doing fd = socket(PF_INET, SOCK_RAW, htons(0x0800)) and the read(fd,...);
> > is a Linux feature.
>
>       Read again: PF_PACKET, not PF_INET.  And it's not a Linux

Uh .. I was wrong sorry ! :)

> feature; AFAIK, it's there in all the platforms with glibc-2 and
> glibc-2.1.

... but AFAIK PF_PACKET is the new method to gain data link layer access
under the 2.1.X and 2.2.0-preX kernel.
It doesn't depend on the glibc version, imho.

> > Ok, I know that SOCK_PACKET is a linux feature too, but the concept is 
> > different.
>
>       PF_PACKET,SOCK_RAW and PF_INET,SOCK_PACKET do exactly the same
> thing, but the former is a GNU standard and the latter is Linux
> specific.

See above. :)

> -- 
> Juan Cespedes


bye bye


                        -- gg sullivan



--
Lorenzo Cavallaro
Intesis SECURITY LAB            Phone: +39-02-671563.1
Via Settembrini, 35             Fax: +39-02-66981953
I-20124 Milano  ITALY           Email: sullivan () seclab com