'SOCK_RAW' option in 'socket' system call

Question

I am new to socket programming and trying my hand on it on Linux machine (ubuntu) I am unable to understand the option 'SOCK_RAW' and want to learn about it. What is the significance of the 'SOCK_RAW' option in 'socket' system call ?

Mecke

Answer 1

Raw mode (by socket type SOCK_RAW) is basically there to allow you to bypass some of the way that your computer handles TCP/IP. Rather than going through the normal layers of encapsulation/decapsulation that the TCP/IP stack on the kernel does, you just pass the packet to the application that needs it. No TCP/IP processing -- so it's not a processed packet, it's a raw packet. The application that's using the packet is now responsible for stripping off the headers, analyzing the packet, all the stuff that the TCP/IP stack in the kernel normally does for you.

For more information see the following links:

• here for raw socket man page
• you can fine a good example here
• here there is a tutorial

Kimmie

Answer 2

What's written in the accepted answer is correct from my understanding and reading man 7 packet, man 7 socket etc. Also this linked SO question describes it well.

However, I want to highlight that SOCK_RAW has different meanings in different contexts (i.e. different AF_* address families). In short, the above answer describes the AF_INET case, where we construct the TCP/IP header by hand. But it's also possible to create a raw socket (a packet socket to be precise) where Ethernet headers are constructed by hand.

I created a graphic to grasp more quickly, which layer is encapsulated by the kernel in which case:

Legend:

Green color means when sending/receiving one has to take care of creating/interpreting the headers in the user space application. Blue color means, it's sufficient to set/get the correct values in an imported sockaddr struct and let the socket interface do the thing.

Red/Orange/Yellow colors are for visual distinction only.

For the bottom part, I'm assuming the user space application is also creating layer 3 and 4 headers, but it doesn't necessarily have to do so. Improvements and corrections are highly welcome, should there be any mistakes.

Greenaway