For most people, being able to use a router to access the internet is enough. However, for a qualified network administrator, it is essential to understand how a router works鈥攅specially how data passes through it.
1. When data passes through a router, the connect function can be called on a raw socket. The connect function only sets the destination address. To reiterate: port numbers are meaningless for raw sockets. For output, after calling connect, since the destination address has already been specified, we can use write or send instead of sendto.
2. Normal output is usually accomplished via sendto or sendmsg by specifying the destination IP address. If the socket is already connected, write, writev, or send can also be used. If the IP_HDRINCL option is not set, the starting address of the data written by the kernel is the first byte after the IP header.
In this case, the kernel constructs the IP header and places it before the data from the process. The kernel sets the protocol field of the IPv4 header to the third argument provided by the user when calling the socket function.
3. If the IP_HDRINCL option is set, the starting address of the data written by the kernel is the first byte of the IP header. The data provided by the user must include the IP header. In this case, the process constructs the entire IP header except for the following two items: the IPv4 identification field can be set to 0, requesting that the kernel set this value. And only when this field is 0 will the kernel set it, and the IPv4 header checksum is calculated and stored by the kernel.
4. If a protocol type is specified when creating the raw socket鈥攖hat is, the third argument protocol鈥攊t does not mean that only packets of that protocol type can be sent. For example, even if protocol is specified as IPPROTO_TCP, you can still send a user-assembled UDP packet. However, if the IP_HDRINCL option is not set at this time, the kernel will indicate in the protocol field of the IP header that the following packet is a TCP packet (even though it is actually a UDP packet).
When the packet reaches the target’s TCP layer, it is generally discarded because no suitable TCP socket can be found to receive it. However, this packet can still be received on a raw socket on the target host.
5. If the IP_HDRINCL option is set, as a rule, you should construct your own IP header. But even if you do not construct an IP header, you can still send data using sendto or sendmsg and specify the destination IP address. However, such packets cannot be received on the target machine using a raw socket, because the IP header is verified in ip_rcv() and the checksum is analyzed, so the packet will be discarded. However, it should be possible to receive the packet at the link layer.
6. If the IP_HDRINCL option is set and the packet is oversized, the data will be discarded and the error code EMSGSIZE will be returned. If the IP_HDRINCL option is not set and the packet is oversized, the packet will be fragmented. To receive data on a raw socket, the received packet must first have a complete and correct IP header; otherwise, it cannot pass the header check and checksum verification in ip_rcv().
7. During the process of receiving packets on a raw socket, the kernel performs checksum verification on the received IP packet but does not inspect or verify any fields beyond the IP header. For example, if we specify the protocol parameter as IPPROTO_TCP when creating a raw socket, the kernel does not perform TCP checksum verification. Instead, it directly copies all packets where the protocol field in the IP header is TCP and delivers them to that raw socket.
8. TCP packets received via a raw socket