Raw IP Networking FAQ

Version 1.3

Last Modified on: Thu Nov 11 18:18:19 PST 1999

The master copy of this FAQ is currently kept at


The webpage also contains material that supplements this FAQ, along with a very spiffy html version.

If you wish to mirror it officially, please contact me for details.


I, Thamer Al-Herbish reserve a collective copyright on this FAQ. Individual contributions made to this FAQ are the intellectual property of the contributor.

I am responsible for the validity of all information found in this FAQ.

This FAQ may contain errors, or inaccurate material. Use it at your own risk. Although an effort is made to keep all the material presented here accurate, the contributors and maintainer of this FAQ will not be held responsible for any damage -- direct or indirect -- which may result from inaccuracies.

You may redistribute this document as long as you keep it in its current form, without any modifications. Please keep it updated if you decide to place it on a publicly accessible server.


The following FAQ attempts to answer questions regarding raw IP or low level IP networking, including raw sockets, and network monitoring APIs such as BPF and DLPI.

Additions and Contributions

If you find anything you can add, have some corrections for me or would like a question answered, please send email to:

Thamer Al-Herbish <shadows@whitefang.com>

Please remember to include whether or not you want your email address reproduced on the FAQ (if you're contributing). Also remember that you may want to post your question to Usenet, instead of sending it to me. If you get a response which is not found on this FAQ, and you feel is relevant, mail me both copies and I'll attempt to include it.

Also a word on raw socket bugs. I get approximately a couple of emails a month about them, and sometimes I just can't verify if the bug exists on a said system. Before mailing in the report, double check with my example source code. If it looks like it's a definite bug, then mail it in.

Special thanks to John W. Temples <john@whitefang.com> for his constant healthy criticism and editing of the FAQ.

Credit is given to the contributor as his/her contribution appears in the FAQ, along with a list of all contributors at the end of this document.

A final note, a Raw IP Networking mailing list is up. You can join by sending an empty message to rawip-subscribe@whitefang.com


This FAQ covers only information relevant to the UNIX environment.

Table of Contents