Send a raw Ethernet frame in Linux

sendRawEth.c

/*
 *  This program is free software: you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation, either version 3 of the License, or
 *  (at your option) any later version.
 */

#include <arpa/inet.h>
#include <linux/if_packet.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
#include <net/if.h>
#include <netinet/ether.h>

#define MY_DEST_MAC0	0x00
#define MY_DEST_MAC1	0x00
#define MY_DEST_MAC2	0x00
#define MY_DEST_MAC3	0x00
#define MY_DEST_MAC4	0x00
#define MY_DEST_MAC5	0x00

#define DEFAULT_IF	"eth0"
#define BUF_SIZ		1024

int main(int argc, char *argv[])
{
	int sockfd;
	struct ifreq if_idx;
	struct ifreq if_mac;
	int tx_len = 0;
	char sendbuf[BUF_SIZ];
	struct ether_header *eh = (struct ether_header *) sendbuf;
	struct iphdr *iph = (struct iphdr *) (sendbuf + sizeof(struct ether_header));
	struct sockaddr_ll socket_address;
	char ifName[IFNAMSIZ];
	
	/* Get interface name */
	if (argc > 1)
		strcpy(ifName, argv[1]);
	else
		strcpy(ifName, DEFAULT_IF);

	/* Open RAW socket to send on */
	if ((sockfd = socket(AF_PACKET, SOCK_RAW, IPPROTO_RAW)) == -1) {
	    perror("socket");
	}

	/* Get the index of the interface to send on */
	memset(&if_idx, 0, sizeof(struct ifreq));
	strncpy(if_idx.ifr_name, ifName, IFNAMSIZ-1);
	if (ioctl(sockfd, SIOCGIFINDEX, &if_idx) < 0)
	    perror("SIOCGIFINDEX");
	/* Get the MAC address of the interface to send on */
	memset(&if_mac, 0, sizeof(struct ifreq));
	strncpy(if_mac.ifr_name, ifName, IFNAMSIZ-1);
	if (ioctl(sockfd, SIOCGIFHWADDR, &if_mac) < 0)
	    perror("SIOCGIFHWADDR");

	/* Construct the Ethernet header */
	memset(sendbuf, 0, BUF_SIZ);
	/* Ethernet header */
	eh->ether_shost[0] = ((uint8_t *)&if_mac.ifr_hwaddr.sa_data)[0];
	eh->ether_shost[1] = ((uint8_t *)&if_mac.ifr_hwaddr.sa_data)[1];
	eh->ether_shost[2] = ((uint8_t *)&if_mac.ifr_hwaddr.sa_data)[2];
	eh->ether_shost[3] = ((uint8_t *)&if_mac.ifr_hwaddr.sa_data)[3];
	eh->ether_shost[4] = ((uint8_t *)&if_mac.ifr_hwaddr.sa_data)[4];
	eh->ether_shost[5] = ((uint8_t *)&if_mac.ifr_hwaddr.sa_data)[5];
	eh->ether_dhost[0] = MY_DEST_MAC0;
	eh->ether_dhost[1] = MY_DEST_MAC1;
	eh->ether_dhost[2] = MY_DEST_MAC2;
	eh->ether_dhost[3] = MY_DEST_MAC3;
	eh->ether_dhost[4] = MY_DEST_MAC4;
	eh->ether_dhost[5] = MY_DEST_MAC5;
	/* Ethertype field */
	eh->ether_type = htons(ETH_P_IP);
	tx_len += sizeof(struct ether_header);

	/* Packet data */
	sendbuf[tx_len++] = 0xde;
	sendbuf[tx_len++] = 0xad;
	sendbuf[tx_len++] = 0xbe;
	sendbuf[tx_len++] = 0xef;

	/* Index of the network device */
	socket_address.sll_ifindex = if_idx.ifr_ifindex;
	/* Address length*/
	socket_address.sll_halen = ETH_ALEN;
	/* Destination MAC */
	socket_address.sll_addr[0] = MY_DEST_MAC0;
	socket_address.sll_addr[1] = MY_DEST_MAC1;
	socket_address.sll_addr[2] = MY_DEST_MAC2;
	socket_address.sll_addr[3] = MY_DEST_MAC3;
	socket_address.sll_addr[4] = MY_DEST_MAC4;
	socket_address.sll_addr[5] = MY_DEST_MAC5;

	/* Send packet */
	if (sendto(sockfd, sendbuf, tx_len, 0, (struct sockaddr*)&socket_address, sizeof(struct sockaddr_ll)) < 0)
	    printf("Send failed\n");

	return 0;
}

@ayepop

First off, it looks like you aren't running this with root privileges.

I saved this code to a file called send_eth.c and compiled it as follows:

gcc -o send_eth -O2 send_eth.c

Then I ran it with root privileges using sudo:

sudo ./send_eth

And it ran without errors, though I haven't yet figured out how to confirm that the frame is actually getting sent out fine.

For a bit more explanation of this code and some questions/comments, check out the original blog post:
http://austinmarton.wordpress.com/2011/09/14/sending-raw-ethernet-packets-from-a-specific-interface-in-c-on-linux/

By using raw sockets is it possible full duplex communication of Ethernet frames

Thanks Austin. This works like a charm. I wanted to send a raw frame without any L3 headers and this worked with the first go.

I changed the #defined mac address parts to the destination mac address.
For anyone else who wants to capture the packets, I used wireshark on both my source machine and destination machine with these filters :

eth.dst == e0:2a:82:43:bb:2e && eth.src == ac:72:88:22:35:30

And it shows the frames being transmitted.

Thanks :)

You can verify the frames are sent by using tcpdump
http://www.tcpdump.org/

sudo tcpdump -i [interface] -Xnn [bpf filter]

For example:
sudo tcpdump -i eth0 -Xnn ip6

Shows all the ipv6 packets going across eth0's ethernet frame.

Thanks for sharing

Hi Austin,
thanks for the blog.
I was wondering if its possible to create such raw socket without using any headers, no IP headers for example. I am writing an application which I want to inject my payload without any alteration (i.e. without addition of any headers) into the MAC/PHY.

In your write application, you create a socket with the protocol as IPPROTO_RAW and set the ether_type as ETH_P_IP. On the other hand in your read application you create a socket with protocol as htons(0x0800) and you don't set ether_type. This works fine for one way communication. I am write an application which communicates in both direction. Once I create a RAW socket, I will use it simultaneously to read and write (via threads). What should be my protocol when creating the RAW socket ? I am sending RAW data over Ethernet (not IP).

Hello,
To my shame, I don't know how exactly to type my mac address. if i put the numbers without : after 0x in mydestmac0 the compiler says
send_eth.c: In function ‘main’:
send_eth.c:64:2: warning: large integer implicitly truncated to unsigned type [-Woverflow]
eh->ether_dhost[0] = MY_DEST_MAC0;

Can anyone tell me how should i write it?
Thank you

Hi,
Can we run this method to send packets to and receive it in the same port ? Like external loopback testing ?
It would be great if anyone can throw some light. If not, is there any other way to do that ?
Thanks.

@nmahaba Were you successful in writing the program ? If yes, can you please share with me . Thanks

@radumos
Suppose you have the following MAC-48 address (in the usual format of six groups of two hexadecimal digits each):

00:11:22:33:44:55

This is how the #define directives must look like:

#define MY_DEST_MAC0    0x00
#define MY_DEST_MAC1    0x11
#define MY_DEST_MAC2    0x22
#define MY_DEST_MAC3    0x33
#define MY_DEST_MAC4    0x44
#define MY_DEST_MAC5    0x55

line 42 strcpy(ifName, argv[1]); - buffer overflow is possible

Why are you filling the sll_addr field of the sockaddr_ll structure ? Is that necessary ?
You are coding with raw sockets, therefore you are already filling the physical layer address in the ethernet frame, so in my opinion it is not required.

It works on eth0, but gives "send failed" on wlan0, any idea?

i define iphdr but it's never used. is it just as example for how u can fill the frame?
other than that nice clean example, thanks

Same result as @RenaKunisaki, except for vlan on eth0

Hi. I had tried to run the code but i got "socket: Operation not permitted
SIOCGIFINDEX: Bad file descriptor
SIOCGIFHWADDR: Bad file descriptor
Send failed"
I had tried to fix it by using the methods proposed but still no avail. Can anyone guide me?

Can this be used to write an arbitrary 802.11 frame like a custom SSID beacon?

For sudo ./sendRawEth wlan0 command,
it was giving following error output
SIOCGIFINDEX: No such device
SIOCGIFHWADDR: No such device
Send failed
Can someone help in resolving this

For sudo ./sendRawEth wlan0 command,
it was giving following error output
SIOCGIFINDEX: No such device
SIOCGIFHWADDR: No such device
Send failed
Can someone help in resolving this

Run with sudo

It works on eth0, but gives "send failed" on wlan0, any idea?

Because it's an ethernet frame ?

Hi. I had tried to run the code but i got "socket: Operation not permitted
SIOCGIFINDEX: Bad file descriptor
SIOCGIFHWADDR: Bad file descriptor
Send failed"
I had tried to fix it by using the methods proposed but still no avail. Can anyone guide me?

you dont have a wlan0. what is your wireless interface name ? ifconfig ?

How about to add close(sockfd); at the end? :)

Is it possible to run the src and destination to the same PC mac address?

what about crc checksum after the payload?

Is IPPROTO_RAW a valid option for AF_PACKET SOCK_RAW socket? However it doesn't matter for sending raw ethernet packet:)

By using raw sockets is it possible full duplex communication of Ethernet frames

If your Ethernet controller is in Full Duplex mode then it will always do so regardless, if it's in Half Duplex then no

Thanks for sharing. It helped a lot.