{ "mode": "man", "parameter": "raw", "section": "7", "url": "https://www.chedong.com/phpMan.php/man/raw/7/json", "generated": "2026-08-15T05:52:35Z", "synopsis": "", "sections": { "NAME": { "content": "raw - Linux IPv4 raw sockets\n", "subsections": [] }, "SYNOPSIS": { "content": "", "subsections": [ { "name": "#include ", "content": "" }, { "name": "#include ", "content": "rawsocket = socket(AFINET, SOCKRAW, int protocol);\n" } ] }, "DESCRIPTION": { "content": "Raw sockets allow new IPv4 protocols to be implemented in user space. A raw socket receives\nor sends the raw datagram not including link level headers.\n\nThe IPv4 layer generates an IP header when sending a packet unless the IPHDRINCL socket op‐\ntion is enabled on the socket. When it is enabled, the packet must contain an IP header.\nFor receiving, the IP header is always included in the packet.\n\nIn order to create a raw socket, a process must have the CAPNETRAW capability in the user\nnamespace that governs its network namespace.\n\nAll packets or errors matching the protocol number specified for the raw socket are passed to\nthis socket. For a list of the allowed protocols, see the IANA list of assigned protocol\nnumbers at \u001b]8;;http://www.iana.org/assignments/protocol-numbers/\u001b\\http://www.iana.org/assignments/protocol-numbers/\u001b]8;;\u001b\\ and getprotobyname(3).\n\nA protocol of IPPROTORAW implies enabled IPHDRINCL and is able to send any IP protocol that\nis specified in the passed header. Receiving of all IP protocols via IPPROTORAW is not pos‐\nsible using raw sockets.\n┌────────────────────────────────────────────────────┐\n│ IP Header fields modified on sending by IPHDRINCL │\n├───────────────────────┬────────────────────────────┤\n│ IP Checksum │ Always filled in │\n├───────────────────────┼────────────────────────────┤\n│ Source Address │ Filled in when zero │\n├───────────────────────┼────────────────────────────┤\n│ Packet ID │ Filled in when zero │\n├───────────────────────┼────────────────────────────┤\n│ Total Length │ Always filled in │\n└───────────────────────┴────────────────────────────┘\n\nIf IPHDRINCL is specified and the IP header has a nonzero destination address, then the des‐\ntination address of the socket is used to route the packet. When MSGDONTROUTE is specified,\nthe destination address should refer to a local interface, otherwise a routing table lookup\nis done anyway but gatewayed routes are ignored.\n\nIf IPHDRINCL isn't set, then IP header options can be set on raw sockets with setsockopt(2);\nsee ip(7) for more information.\n\nStarting with Linux 2.2, all IP header fields and options can be set using IP socket options.\nThis means raw sockets are usually needed only for new protocols or protocols with no user\ninterface (like ICMP).\n\nWhen a packet is received, it is passed to any raw sockets which have been bound to its pro‐\ntocol before it is passed to other protocol handlers (e.g., kernel protocol modules).\n", "subsections": [ { "name": "Address format", "content": "For sending and receiving datagrams (sendto(2), recvfrom(2), and similar), raw sockets use\nthe standard sockaddrin address structure defined in ip(7). The sinport field could be\nused to specify the IP protocol number, but it is ignored for sending in Linux 2.2 and later,\nand should be always set to 0 (see BUGS). For incoming packets, sinport is set to zero.\n" }, { "name": "Socket options", "content": "Raw socket options can be set with setsockopt(2) and read with getsockopt(2) by passing the\nIPPROTORAW family flag.\n\nICMPFILTER\nEnable a special filter for raw sockets bound to the IPPROTOICMP protocol. The value\nhas a bit set for each ICMP message type which should be filtered out. The default is\nto filter no ICMP messages.\n\nIn addition, all ip(7) IPPROTOIP socket options valid for datagram sockets are supported.\n" }, { "name": "Error handling", "content": "Errors originating from the network are passed to the user only when the socket is connected\nor the IPRECVERR flag is enabled. For connected sockets, only EMSGSIZE and EPROTO are\npassed for compatibility. With IPRECVERR, all network errors are saved in the error queue.\n" } ] }, "ERRORS": { "content": "EACCES User tried to send to a broadcast address without having the broadcast flag set on the\nsocket.\n\nEFAULT An invalid memory address was supplied.\n\nEINVAL Invalid argument.\n\nEMSGSIZE\nPacket too big. Either Path MTU Discovery is enabled (the IPMTUDISCOVER socket\nflag) or the packet size exceeds the maximum allowed IPv4 packet size of 64 kB.\n\nEOPNOTSUPP\nInvalid flag has been passed to a socket call (like MSGOOB).\n\nEPERM The user doesn't have permission to open raw sockets. Only processes with an effec‐\ntive user ID of 0 or the CAPNETRAW attribute may do that.\n\nEPROTO An ICMP error has arrived reporting a parameter problem.\n", "subsections": [] }, "VERSIONS": { "content": "IPRECVERR and ICMPFILTER are new in Linux 2.2. They are Linux extensions and should not be\nused in portable programs.\n\nLinux 2.0 enabled some bug-to-bug compatibility with BSD in the raw socket code when the\nSOBSDCOMPAT socket option was set; since Linux 2.2, this option no longer has that effect.\n", "subsections": [] }, "NOTES": { "content": "By default, raw sockets do path MTU (Maximum Transmission Unit) discovery. This means the\nkernel will keep track of the MTU to a specific target IP address and return EMSGSIZE when a\nraw packet write exceeds it. When this happens, the application should decrease the packet\nsize. Path MTU discovery can be also turned off using the IPMTUDISCOVER socket option or\nthe /proc/sys/net/ipv4/ipnopmtudisc file, see ip(7) for details. When turned off, raw\nsockets will fragment outgoing packets that exceed the interface MTU. However, disabling it\nis not recommended for performance and reliability reasons.\n\nA raw socket can be bound to a specific local address using the bind(2) call. If it isn't\nbound, all packets with the specified IP protocol are received. In addition, a raw socket\ncan be bound to a specific network device using SOBINDTODEVICE; see socket(7).\n\nAn IPPROTORAW socket is send only. If you really want to receive all IP packets, use a\npacket(7) socket with the ETHPIP protocol. Note that packet sockets don't reassemble IP\nfragments, unlike raw sockets.\n\nIf you want to receive all ICMP packets for a datagram socket, it is often better to use\nIPRECVERR on that particular socket; see ip(7).\n\nRaw sockets may tap all IP protocols in Linux, even protocols like ICMP or TCP which have a\nprotocol module in the kernel. In this case, the packets are passed to both the kernel mod‐\nule and the raw socket(s). This should not be relied upon in portable programs, many other\nBSD socket implementation have limitations here.\n\nLinux never changes headers passed from the user (except for filling in some zeroed fields as\ndescribed for IPHDRINCL). This differs from many other implementations of raw sockets.\n\nRaw sockets are generally rather unportable and should be avoided in programs intended to be\nportable.\n\nSending on raw sockets should take the IP protocol from sinport; this ability was lost in\nLinux 2.2. The workaround is to use IPHDRINCL.\n", "subsections": [] }, "BUGS": { "content": "Transparent proxy extensions are not described.\n\nWhen the IPHDRINCL option is set, datagrams will not be fragmented and are limited to the\ninterface MTU.\n\nSetting the IP protocol for sending in sinport got lost in Linux 2.2. The protocol that the\nsocket was bound to or that was specified in the initial socket(2) call is always used.\n", "subsections": [] }, "SEE ALSO": { "content": "recvmsg(2), sendmsg(2), capabilities(7), ip(7), socket(7)\n\nRFC 1191 for path MTU discovery. RFC 791 and the header file for the IP proto‐\ncol.\n\nLinux man-pages 6.7 2023-10-31 raw(7)", "subsections": [] } }, "summary": "raw - Linux IPv4 raw sockets", "flags": [], "examples": [], "see_also": [ { "name": "recvmsg", "section": "2", "url": "https://www.chedong.com/phpMan.php/man/recvmsg/2/json" }, { "name": "sendmsg", "section": "2", "url": "https://www.chedong.com/phpMan.php/man/sendmsg/2/json" }, { "name": "capabilities", "section": "7", "url": "https://www.chedong.com/phpMan.php/man/capabilities/7/json" }, { "name": "ip", "section": "7", "url": "https://www.chedong.com/phpMan.php/man/ip/7/json" }, { "name": "socket", "section": "7", "url": "https://www.chedong.com/phpMan.php/man/socket/7/json" } ] }