# divert sockets and ethernet header



## yavuzg (Jan 28, 2010)

Hi all,

Man page of divert says that "Divert sockets are similar to raw IP sockets, except that they can be bound to a specific divert port via the bind(2) system call". But I think there is one more difference between divert sockets and raw sockets. When I use divert socket I get an IP packet, ethernet header is stripped off. 

I use below rule in ipfw.

```
divert 5000 ip from any to any dst-port 2000 in
```

Is it possible to get entire packet (in or out) via divert sockets?

I read the man page of ipfw, packet flow part seems relevant. But I couldn't divert packets from lower layers (with ethernet header) but couldn't achieve. 

thanks in advance,
yavuz


----------



## expl (Jan 28, 2010)

If I understand correctly the divert socket mechanics are based around bind syscall making ethernet headers irrelevant to your program as your filter is based around IP protocol and filtered by port(s) and IP hosts. If you want to get to lower layers I think its much more simple to use bpf(4) handle the raw stream and filtering yourself in userland rather than by ipfw kernel module.


----------

