linuxnetwork-programmingethernetlibpcapraw-ethernet

Does libpcap use the traffic control layer of linux?

I was working on creating a separate network stack and I'm using libpcap, or specifically, pcap_inject function to send packets directly to the link layer. However, when I look into the tc -s qdisc show dev eth0 command, I see that the packets I send are counting towards the packets sent from the queue. So my question is, does pcap_inject call the traffic control layer of linux to send packets? Or does it directly send to the device driver?

Thanks in advance

Solution

  • does pcap_inject call the traffic control layer of linux to send packets? Or does it directly send to the device driver?

    It does a send() call on a PF_PACKET socket. By default, packets sent on those sockets go through the traffic control layer; to quote the PF_PACKET socket man page:

       PACKET_QDISC_BYPASS (since Linux 3.14)
          By default, packets sent through packet sockets pass through
          the kernel's qdisc (traffic control) layer, which is fine for
          the vast majority of use cases.  For traffic generator appli‐
          ances using packet sockets that intend to brute-force flood
          the network—for example, to test devices under load in a simi‐
          lar fashion to pktgen—this layer can be bypassed by setting
          this integer option to 1.  A side effect is that packet
          buffering in the qdisc layer is avoided, which will lead to
          increased drops when network device transmit queues are busy;
          therefore, use at your own risk.

    libpcap does not turn that option on.