I was wondering if anyone knows exactly where a recv called on an unbound PF_PACKET/SOCK_RAW socket comes in. Basically, I'm writing something that needs to do a bunch of stuff at a bunch of different levels. But I am also running it with SOCK_STREAM sockets bound to ports as well. Will this create race conditions?

My basic question is whether the data "recv"ed by the unbound PF_PACKET socket is data that is copied into those buffers, and the higher level SOCK_STREAM socket bound to some port or other also has a copy of that data in its buffers, or whether its a case of whichever "recv" gets called first, gets the data.

If its unfortunately the later case, is there anyway I can put data "recv"ed on the unbound PF_PACKET back onto the queue, or ignore it and leave it for the bound SOCK_STREAM socket?

I'm starting to think that maybe they do have seperate buffers and the PF_PACKET has its own copy. My reasoning for this is that, A, in the past this program has worked fairly well, and tcpdump has not reported TCP resends on the SOCK_STREAM port. This indicates to me that these packets are being received by that higher level socket, and dealt with appropriately and that the PF_PACKET socket can throw these away when it sees them. That's another question though. If I have this unbound PF_PACKET socket, the bound SOCK_STREAM socket, and then tcpdump running.. who gets what? Are they all given seperate copies of packets "bound" for them to work with? Or are they all taking things off a global queue and only tcpdump is actually (through its libpcap interface) handling these packets properly like a filter. Also, B, I tried using MSG_PEEK on the PF_PACKET recvs under the thought that this would leave the packets bound for other sockets on this imagined "global buffer". This created horrible problems and worked much worse (if at all) then just taking them off and chucking the ones unwanted.

Any knowledge someone could express with regards to the ordering of this packet capturing things would be quite helpful but please refrain from suggesting I use libpcap. ;-) I have in the past for other projects but I'm just not interested in the extra lib overhead for this application(i.e I want to do everything myself).