I am creating socket as follows: ============================= static void create_new_read_socket( const uint64_t card_pos ) { const int read_sock = available_cards[card_pos].read_socket = socket( PF_PACKET, SOCK_RAW|SOCK_NONBLOCK, htons( ETH_P_ALL ) ); if( read_sock < 0 ) { fprintf( stderr, "%s %d Unable to create read_sock", __func__, __LINE__ ); return; } struct ifreq ifr; strncpy( ifr.ifr_name, available_cards[card_pos].card_name, IFNAMSIZ ); if( ioctl( read_sock, SIOCGIFFLAGS, &ifr ) == -1 ) { fprintf( stderr, "%s %d Unable to get flag", __func__, __LINE__ ); return; } available_cards[card_pos].ifr_flags_backup = ifr.ifr_flags; ifr.ifr_flags |= ( IFF_PROMISC | IFF_UP ); if( ioctl( read_sock, SIOCSIFFLAGS, &ifr ) == -1 ) { fprintf( stderr, "%s %d Unable to set promiscious flag", __func__, __LINE__ ); return; } struct sockaddr_ll ll = { .sll_family = PF_PACKET, .sll_protocol = htons(ETH_P_ALL), .sll_ifindex = (int)available_cards[card_pos].index }; if( bind( read_sock, (struct sockaddr *) &ll, sizeof(ll) ) < 0 ) { fprintf( stderr, "%s %d Unable to bind", __func__, __LINE__ ); return; } const int one = 1; if( setsockopt( read_sock, SOL_PACKET, PACKET_AUXDATA, &one, sizeof(one)) < 0 ) { fprintf( stderr, "%s %d Unable to setsockopt PACKET_AUXDATA", __func__, __LINE__ ); return; } } ============================= reading the packet as follows: ============================= read_return = recvmsg( read_socket, &msg, MSG_DONTWAIT ); ============================= I am seeing recvmsg is returning buffer filled with zeros but returning size is accurate.
full code can be found here... https://www.linuxquestions.org/questions/programming-9/vlan-tag-missing-in-packets-captured-using-custom-socket-but-visible-in-wireshark-4175671314/#post6105820