Question

当我在环回接口（lo）上打开packetsocket并监听所有数据包时，会看到两次。为什么会这样？

但是使用tcpdump在接口上捕获正确地忽略了重复的条目。请参阅“过滤器接收的数据包”（包含重复的数据包）和“捕获的数据包”。如何完成此过滤

tcpdump -i lo -s 0

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 65535 bytes
11:00:08.439542 IP 12.0.0.3 > localhost.localdomain: icmp 64: echo request seq 1
11:00:08.439559 IP localhost.localdomain > 12.0.0.3: icmp 64: echo reply seq 1
11:00:09.439866 IP 12.0.0.3 > localhost.localdomain: icmp 64: echo request seq 2
11:00:09.439884 IP localhost.localdomain > 12.0.0.3: icmp 64: echo reply seq 2
11:00:10.439389 IP 12.0.0.3 > localhost.localdomain: icmp 64: echo request seq 3
11:00:10.439410 IP localhost.localdomain > 12.0.0.3: icmp 64: echo reply seq 3

6 packets captured
12 packets received by filter
0 packets dropped by kernel

我的代码：

int main()
{
  int sockFd;

  if ( (sockFd=socket(PF_PACKET, SOCK_DGRAM, 0))<0 ) {
    perror("socket()");
    return -1;
  }

  /* bind the packet socket */
  struct sockaddr_ll addr;
  struct ifreq ifr;
  strncpy (ifr.ifr_name, "lo", sizeof(ifr.ifr_name));
  if(ioctl(sockFd, SIOCGIFINDEX, &ifr) == -1)
  {
    perror("iotcl");
    return -1;
  }
  memset(&addr, 0, sizeof(addr));
  addr.sll_family=AF_PACKET;
  addr.sll_protocol=htons(ETH_P_ALL);
  addr.sll_ifindex=ifr.ifr_ifindex;
  if ( bind(sockFd, (struct sockaddr *)&addr, sizeof(addr)) ) {
    perror("bind()");
    return -1;
  }

  char buffer[MAX_BUFFER+1];
  int tmpVal = 1;

  while(tmpVal > 0)
  {
    tmpVal = recv (sockFd, buffer, MAX_BUFFER, 0);
    cout<<"Received Pkt with Bytes "<<tmpVal <<endl;
  }
}

Answer 1

找出问题所在。

来自libcaps代码：

 *   - The loopback device gives every packet twice; on 2.2[.x] kernels,
 *     if we use PF_PACKET, we can filter out the transmitted version
 *     of the packet by using data in the "sockaddr_ll" returned by
 *     "recvfrom()", but, on 2.0[.x] kernels, we have to use
 *     PF_INET/SOCK_PACKET, which means "recvfrom()" supplies a
 *     "sockaddr_pkt" which doesn't give us enough information to let
 *     us do that.

侦听实体需要使用从recvfrom api获得的if_index来过滤重复的数据包。

在loopback设备上打开的packetsocket接收所有数据包两次。如何过滤这些重复的条目？

1 个答案: