Very Computer

  I'm interested in binding a socket to a device, and have looked at
the pcap source code. In pcap-linux.c, a generic socket address
stucture is used, and a string containing the name of the device to
use is placed in the data portion.  This address structure is then
used in the call to bind.  This seems odd to me and I haven't figured
out from the sock man page why this would work.  The packet man page
suggests using a sockaddr_ll structure, which contains the hardware
address of the device, in the call to bind.  Any idea why this first
method which seems bizzarre to me, would work?

|  I'm interested in binding a socket to a device, and have looked at
|the pcap source code. In pcap-linux.c, a generic socket address
|stucture is used, and a string containing the name of the device to
|use is placed in the data portion.  This address structure is then
|used in the call to bind.  This seems odd to me and I haven't figured
|out from the sock man page why this would work.  The packet man page
|suggests using a sockaddr_ll structure, which contains the hardware
|address of the device, in the call to bind.  Any idea why this first
|method which seems bizzarre to me, would work?

What bind in general does is connect a socket to a local communication
endpoint. In the IP world sockaddr is a IPv4 address. The designers of
the socket API were far sighted enough to see that bind should work with
other protocols also, e.g. X500. So what is passed is the address of an
endpoint (of whatver type is suitable for the protocol stack) and a
length. So the second argument is whatever your protocol stack wants and
the third argument is the length in bytes of the second argument.

See section "COMPATIBILITY" of the packet(7) man page. Your version of
pcap still seems to use the old (PF_INET, SOCK_PACKET). The sockaddr
structure then is defined as:

              struct sockaddr_pkt
              {
                  unsigned short  spkt_family;
                  unsigned char   spkt_device[14];
                  unsigned short  spkt_protocol;
              };

So if one does use the usual approach to set all the memory of the
structure to zero before using it, one could just use the generic struct
sockaddr and fill sa_addr with the name of the device. The device name
then should not exceed 13 chars then, but a 14 chars device name might
work still.

Using the generic struct sockaddr might be caused by problems
experienced when including kernel headers into user space applications.
Old libc versions might not define struct sockaddr_pkt. So it is fine
for the special case of libpcap to circumvent the problems, but is not a
general way to solve such problem when writing a new application. You
should upgrade your libpcap to something more recent (using AF_PACKET)
anyway. While current Linux 2.4 kernels still warn on usage of (AF_INET,
SOCK_PACKET), support might completely disappear during the Linux 2.5
development.

Michael