原始套接字未在正确的接口上捕获DHCP数据包,但Wireshark

下面是一个原始套接字嗅探器的C应用程序示例:

https://www.binarytides.com/packet-sniffer-code-c-linux/

除了我在创建套接字后将套接字绑定到接口之外:

const std::string& iff = "wlp3s0";

int r = setsockopt(sock_raw, SOL_SOCKET, SO_BINDTODEVICE, iff.c_str(), iff.length());
if (r == -1)
{
    std::abort();
}

然后我让应用程序继续运行:

sudo ./the_app

我打开Wireshark,收听wlp3s0无线接口。我从捕获中删除了有线以太网接口。

然后我就跑 sudo dhclient -r 和 sudo dhclient 停止/启动DHCP,Wireshark检测到4或5个DHCP数据包,如预期的那样:

然而,C原始套接字嗅探器显示绝对没有接收到UDP数据包。

如果我打开一个网络浏览器,它会开始显示TCP数据包(Wireshark报告DHCP数据包是UDP)。

发生了什么事?我使用的是Ubuntu 22.04

最小示例:

#include<stdio.h>   //For standard things
#include<stdlib.h>  //malloc
#include<string.h>  //memset
#include<netinet/ip_icmp.h> //Provides declarations for icmp header
#include<netinet/udp.h> //Provides declarations for udp header
#include<netinet/tcp.h> //Provides declarations for tcp header
#include<netinet/ip.h>  //Provides declarations for ip header
#include<sys/socket.h>
#include<arpa/inet.h>
#include <unistd.h>

void ProcessPacket(unsigned char* , int);

int tcp=0,udp=0,icmp=0,others=0,igmp=0,total=0,i,j;
struct sockaddr_in source,dest;

int main()
{    
    unsigned char *buffer = (unsigned char *)malloc(65536); //Its Big!
    
    printf("Starting...\n");
    int sock_raw = socket(AF_INET , SOCK_RAW , IPPROTO_TCP);

    if(sock_raw < 0)
    {
        std::abort();
    }

    int r = setsockopt(sock_raw, SOL_SOCKET, SO_BINDTODEVICE, "wlp3s0", strlen("wlp3s0"));
    
    if (r == -1)
    {
        std::abort();
    }
   
    while(1)
    {
        int data_size = recv(sock_raw , buffer , 65536 , 0);
        
        if(data_size <0 )
        {
            std::abort();
        }

        ProcessPacket(buffer , data_size);
    }
    
    ::close(sock_raw);
    return 0;
}

void ProcessPacket(unsigned char* buffer, int size)
{
    //Get the IP Header part of this packet
    struct iphdr *iph = (struct iphdr*)buffer;
    ++total;
    switch (iph->protocol) //Check the Protocol and do accordingly...
    {
        case 1:  //ICMP Protocol
            ++icmp;
            //print_icmp_packet(buffer, size);
            break;
        
        case 2:  //IGMP Protocol
            ++igmp;
            break;
        
        case 6:  //TCP Protocol
            ++tcp;
            //print_tcp_packet(buffer , size);
            break;
        
        case 17: //UDP Protocol
            ++udp;
            //print_udp_packet(buffer , size);
            break;
        
        default: //Some Other Protocol like ARP etc.
            ++others;
            break;
    }

    printf("TCP : %d   UDP : %d   ICMP : %d   IGMP : %d   Others : %d   Total : %d\r",tcp,udp,icmp,igmp,others,total);
}