In most modern systems incorporating TCP/IP, the socket interface is the only way applications can use the TCP/IP suite of protocols. In my previous article, we mentioned that the socket interface is TCP/IP’s window on the world. So the next question is: what the PF_PACKET socket is? PF_PACKET socket But in this article, I want to focus on the Linux platform, so how does libpcap work on the Linux system? According to some documents, it turns out that libpcap uses the PF_PACKET socket to capture packets on a network interface.

libpcap covers all of these differences and provides the system-independent interface for user-level packet capture. According to the official document, tcpdump is built on the library libpcap, which is developed based on the remarkable research result from Berkeley, in details you can refer to this paper.Īs you know, different operating systems have different internal implementations of network stacks. Thanks Introductionįirstly, we need to review how tcpdump is implemented. Note this article is originally published on my personal blog here. This article will focus on the Linux platform. Note that different operating system kernels have different internal network implementations. After reading this article, you can find that it is not as difficult as you think. Sounds complex, right? In this article, let us do it. But have you ever thought about writing a packet sniffer from scratch without dependencies on any third-party libraries? We need to dig deep into the operating system and find the weapons needed to build this tool.

I have shown you how to capture network packets in my previous articles with such tools. When we refer to network packet sniffer, some famous and popular tools come to your mind, like tcpdump.

Write a Linux packet sniffer from scratch with Raw socket and BPF Background

Python packet sniffer