title: AF_PACKET and Ethernet
body: <p>I'm very confused about exactly how the <code>AF_PACKET</code> socket family (for <code>SOCK_RAW</code> sockets) specifically relates to Ethernet (IEEE 802.3).</p>
  
  <p><strong>What I understand so far:</strong></p>
  
  <ul>
  <li><p>I understand the OSI Model, and how Layer 2 technologies like
  Ethernet fit into the model.</p></li>
  <li><p>I understand that <code>AF_PACKET</code> can be used with a <code>SOCK_RAW</code> socket to
  receive datagrams that contain a 14-byte Ethernet header, followed by some
  other higher layer protocol header(s), such as IPv4, IPv6, etc.,
  followed by optionally a transport layer protocol like TCP, and
  finally a payload.</p></li>
  <li><p>I understand you can pass flags such as <code>ETH_P_ALL</code> or <code>ETH_P_IP</code> as
  the protocol argument to <code>socket</code> to have the kernel filter packets
  for you, by only sending you packets containing headers of a certain
  type.</p></li>
  <li>I understand that sockets created with the <code>AF_PACKET</code> family can receive or send to endpoints of type <code>sockaddr_ll</code>, which is associated with a particular MAC address (EUI-48 address), along with a particular network interface (such as <code>eth0</code> or whatever).</li>
  </ul>
  
  <p><strong>What I DON'T understand:</strong></p>
  
  <ul>
  <li><p>I don't understand if <code>AF_PACKET</code> is supposed to exclusively work with Ethernet devices, as opposed to other Layer 2 technologies, such as Wifi, Bluetooth, Token Ring, Infiniband, etc.</p></li>
  <li><p>I don't understand the relationship between Ethernet <em>devices</em> versus Layer 2 protocols that use the 14-byte <strong><em>Ethernet header</em></strong>.  The Ethernet header is 14-bytes, and can be defined as something like: <code>struct eth_hdr { char dest_address[6]; char source_address[6]; uint16_t ethertype; };</code>  In other words, is this header only used with physical Ethernet devices?  It seems the answer is <strong>no</strong>, because if I use <code>AF_PACKET</code> on the loopback interface, I still receive packets containing 14-byte <em>Ethernet headers</em>.  But loopback is <em>not</em> an Ethernet device.  So why does it receive packets containing Ethernet headers?</p></li>
  <li><p>If <code>AF_PACKET</code> can be used with non-Ethernet devices, does the <code>ETH_P_ALL</code> protocol flag indicate to only accept packets that specifically have a 14-byte Ethernet header?</p></li>
  </ul>
  
  <p><br></p>
  
  <p><strong>My question(s):</strong></p>
  
  <p>Does using <code>AF_PACKET</code> imply you are guaranteed to <em>always</em> receive packets with 14-byte Ethernet headers?</p>
  
  <p>If so, does that also imply that <code>AF_PACKET</code> is meant to be used ONLY with Ethernet devices (as opposed to other Layer 2 technologies, like Wifi, Token Ring, Bluetooth, Infiniband, etc.)?</p>
  
  <p>If the answer to either of these questions is <strong>NO</strong>, then how can an application programatically determine what type of Layer 2 header to expect when receiving a datagram on an <code>AF_PACKET</code> socket?</p>