Cannot sniff UDP packets in C without Wireshark running

Question

I have a setup that looks like this:

Target ---- Switch ---- Switch ---- Windows computer
                           |
                     Linux computer

So I have a target connected to a switch it sends out UDP-packets for debug purpose. Normally these packets goes to a Windows computer for analysis, this works. I have now added a Linux computer as well, to get the same data to both Linux and Windows I have setup a managed switch to mirror the traffic, this works fine when I look in Wireshark. I have then written a simple C-application for analysing the data on the Linux computer, this software does only work if Wireshark is running at the same time. Otherwise it does not receive any data from the target. Why is this?

int main()
{
   int saddr_size, data_size;
   struct sockaddr saddr;

   unsigned char *buffer = (unsigned char *) malloc(BUFFER_SIZE);

   printf("Starting...\n");

   int sock_raw = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));

   if (sock_raw < 0)
   {
      printf("Socket Error");
      return 1;
   }

   while (1)
   {
      saddr_size = sizeof saddr;
      data_size = recvfrom(sock_raw, buffer, BUFFER_SIZE, 0, &saddr, (socklen_t*) &saddr_size);
      if (data_size < 0)
      {
         printf("Recvfrom error , failed to get packets\n");
         return 1;
      }
      processPacket(buffer);
   }
   close(sock_raw);
   printf("Finished");
   return 0;
}

The data coming from the target are sent on a format similar to RTP and is addressed to the Windows computer.

So to sum up; Why do I not receive any data from the target in my C-application without Wireshark running?

Andrew Henle Andrew Henle · Accepted Answer · 2015-05-05T10:49:22

Same as here, you need to put the interface (not socket as I originally posted) into promiscuous mode. Wireshark does that, which is why your code works when Wireshark is running.

Cannot sniff UDP packets in C without Wireshark running

2 Answers