From owner-freebsd-questions  Wed Oct  2 16:53:49 1996
Return-Path: owner-questions
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.5/8.7.3) id QAA15352
          for questions-outgoing; Wed, 2 Oct 1996 16:53:49 -0700 (PDT)
Received: from alpha.xerox.com (alpha.Xerox.COM [13.1.64.93])
          by freefall.freebsd.org (8.7.5/8.7.3) with SMTP id QAA15347
          for <questions@freebsd.org>; Wed, 2 Oct 1996 16:53:46 -0700 (PDT)
Received: from crevenia.parc.xerox.com ([13.2.116.11]) by alpha.xerox.com with SMTP id <14527(7)>; Wed, 2 Oct 1996 16:53:04 PDT
Received: from localhost ([127.0.0.1]) by crevenia.parc.xerox.com with SMTP id <177476>; Wed, 2 Oct 1996 16:52:51 -0700
X-Mailer: exmh version 1.6.7 5/3/96
To: shadows@whitefang.com
cc: questions@freebsd.org
Subject: Re: SOCK_RAW & IPPROTO_TCP semantics 
In-reply-to: Your message of "Tue, 01 Oct 1996 22:00:05 PDT."
             <Pine.NEB.3.95.961002075730.6175B-100000@broken.whitefang.com> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Wed, 2 Oct 1996 16:52:40 PDT
From: Bill Fenner <fenner@parc.xerox.com>
Message-Id: <96Oct2.165251pdt.177476@crevenia.parc.xerox.com>
Sender: owner-questions@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

SOCK_RAW is only for packets that other protocols haven't claimed already.  
Since TCP is already implemented in the kernel, the raw interface doesn't get 
the packets at all.

The only way I know of to grab all TCP packets would be using BPF.

  Bill