3 ms·

I always assumed any TCP/UDP packets would get captured by the OS network stack in order to be sent only to the processes listening on specific ports. I guess

I always assumed any TCP/UDP packets would get captured by the OS network stack in order to be sent only to the processes listening on specific ports. I guess this is a security feature, since a process cannot even listen on some ports without having elevated privileges. I wouldn't expect another process being able to capture all this traffic anyway. This would also require a mechanism of sending the same stream to multiple processes (TCP listeners and all-protocol listeners). But I didn't even know it was possible to capture traffic from multiple transport layer protocols using a syscall, perhaps that syscall requires elevated privileges itself..?

Hawzen 2y ago
> perhaps that syscall requires elevated privileges itself..? You are exactly right
globular-toast 2y ago
It requires elevated privileges, but this is how programs like tcpdump and wireshark work. On Linux it's also possible to give a program these permissions for any user by setting "capabilities", specifically cap_net_admin and cap_net_raw.
netbsdusers 2y ago
DHCP services require this ability to receive and send UDP packets on raw sockets, barring a few advanced systems like Solaris that provide them with necessary facilities. Usually they install a BPF module on the socket to filter out uninteresting packets. https://kb.isc.org/docs/aa-00379 https://kb.isc.org/docs/aa-00379