1 .\" Copyright (c) 1983, 1991, 1993
2 .\" The Regents of the University of California. All rights reserved.
4 .\" Redistribution and use in source and binary forms, with or without
5 .\" modification, are permitted provided that the following conditions
7 .\" 1. Redistributions of source code must retain the above copyright
8 .\" notice, this list of conditions and the following disclaimer.
9 .\" 2. Redistributions in binary form must reproduce the above copyright
10 .\" notice, this list of conditions and the following disclaimer in the
11 .\" documentation and/or other materials provided with the distribution.
12 .\" 3. Neither the name of the University nor the names of its contributors
13 .\" may be used to endorse or promote products derived from this software
14 .\" without specific prior written permission.
16 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
17 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
20 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 .\" @(#)ip.4 8.2 (Berkeley) 11/30/93
42 .Fn socket AF_INET SOCK_RAW proto
45 is the transport layer protocol used
46 by the Internet protocol family.
47 Options may be set at the
50 when using higher-level protocols that are based on
56 It may also be accessed
59 when developing new protocols, or
60 special-purpose applications.
69 may be used to provide
71 options to be transmitted in the
73 header of each outgoing packet
74 or to examine the header options on incoming packets.
76 options may be used with any socket type in the Internet family.
79 options to be sent is that specified by the
81 protocol specification (RFC-791), with one exception:
82 the list of addresses for Source Route options must include the first-hop
83 gateway at the beginning of the list of gateways.
84 The first-hop gateway address will be extracted from the option list
85 and the size adjusted accordingly before use.
86 To disable previously specified options,
87 use a zero-length buffer:
89 setsockopt(s, IPPROTO_IP, IP_OPTIONS, NULL, 0);
95 may be used to set the type-of-service and time-to-live
99 .Dv SOCK_STREAM , SOCK_DGRAM ,
105 int tos = IPTOS_LOWDELAY; /* see <netinet/ip.h> */
106 setsockopt(s, IPPROTO_IP, IP_TOS, &tos, sizeof(tos));
108 int ttl = 60; /* max = 255 */
109 setsockopt(s, IPPROTO_IP, IP_TTL, &ttl, sizeof(ttl));
113 may be used to set the minimum acceptable TTL a packet must have when
114 received on a socket.
115 All packets with a lower TTL are silently dropped.
116 This option is only really useful when set to 255, preventing packets
117 from outside the directly connected networks reaching local listeners
121 may be used to set the Don't Fragment flag on IP packets.
122 Currently this option is respected only on
131 sockets, the Don't Fragment flag is controlled by the Path
132 MTU Discovery option.
133 Sending a packet larger than the MTU size of the egress interface,
134 determined by the destination address, returns an
140 option is enabled on a
145 call will return the destination
154 structure points to a buffer
157 structure followed by the
162 fields have the following values:
164 cmsg_len = CMSG_LEN(sizeof(struct in_addr))
165 cmsg_level = IPPROTO_IP
166 cmsg_type = IP_RECVDSTADDR
169 The source address to be used for outgoing
171 datagrams on a socket can be specified as ancillary data with a type code of
173 The msg_control field in the msghdr structure should point to a buffer
176 structure followed by the
179 The cmsghdr fields should have the following values:
181 cmsg_len = CMSG_LEN(sizeof(struct in_addr))
182 cmsg_level = IPPROTO_IP
183 cmsg_type = IP_SENDSRCADDR
186 The socket should be either bound to
188 and a local port, and the address supplied with
192 or the socket should be bound to a local address and the address supplied with
196 In the latter case bound address is overriden via generic source address
197 selection logic, which would choose IP address of interface closest to
202 is defined to have the same value as
208 can be used directly as a control message for
214 option is enabled on a
218 socket, the destination address of outgoing
219 broadcast datagrams on that socket will be forced
220 to the undirected broadcast address,
221 .Dv INADDR_BROADCAST ,
223 This is in contrast to the default behavior of the
224 system, which is to transmit undirected broadcasts
225 via the first network interface with the
229 This option allows applications to choose which
230 interface is used to transmit an undirected broadcast
232 For example, the following code would force an
233 undirected broadcast to be transmitted via the interface
234 configured with the broadcast address 192.168.2.255:
237 struct sockaddr_in sin;
238 int onesbcast = 1; /* 0 = disable (default), 1 = enable */
240 setsockopt(s, IPPROTO_IP, IP_ONESBCAST, &onesbcast, sizeof(onesbcast));
241 sin.sin_addr.s_addr = inet_addr("192.168.2.255");
242 sin.sin_port = htons(1234);
243 sendto(s, msg, sizeof(msg), 0, &sin, sizeof(sin));
246 It is the application's responsibility to set the
249 to an appropriate value in order to prevent broadcast storms.
250 The application must have sufficient credentials to set the
252 socket level option, otherwise the
254 option has no effect.
258 option is enabled on a
265 to any address, even one not bound to any available network interface in the
267 This functionality (in conjunction with special firewall rules) can be used for
268 implementing a transparent proxy.
270 .Dv PRIV_NETINET_BINDANY
271 privilege is needed to set this option.
275 option is enabled on a
282 (time to live) field for a
285 The msg_control field in the msghdr structure points to a buffer
286 that contains a cmsghdr structure followed by the
288 The cmsghdr fields have the following values:
290 cmsg_len = CMSG_LEN(sizeof(u_char))
291 cmsg_level = IPPROTO_IP
292 cmsg_type = IP_RECVTTL
298 option is enabled on a
305 (type of service) field for a
308 The msg_control field in the msghdr structure points to a buffer
309 that contains a cmsghdr structure followed by the
311 The cmsghdr fields have the following values:
313 cmsg_len = CMSG_LEN(sizeof(u_char))
314 cmsg_level = IPPROTO_IP
315 cmsg_type = IP_RECVTOS
321 option is enabled on a
326 .Vt "struct sockaddr_dl"
327 corresponding to the interface on which the
333 structure points to a buffer that contains a
335 structure followed by the
336 .Vt "struct sockaddr_dl" .
339 fields have the following values:
341 cmsg_len = CMSG_LEN(sizeof(struct sockaddr_dl))
342 cmsg_level = IPPROTO_IP
343 cmsg_type = IP_RECVIF
347 may be used to set the port range used for selecting a local port number
348 on a socket with an unspecified (zero) port number.
351 .Bl -tag -width IP_PORTRANGE_DEFAULT
352 .It Dv IP_PORTRANGE_DEFAULT
353 use the default range of values, normally
354 .Dv IPPORT_HIFIRSTAUTO
356 .Dv IPPORT_HILASTAUTO .
357 This is adjustable through the sysctl setting:
358 .Va net.inet.ip.portrange.first
360 .Va net.inet.ip.portrange.last .
361 .It Dv IP_PORTRANGE_HIGH
362 use a high range of values, normally
363 .Dv IPPORT_HIFIRSTAUTO
365 .Dv IPPORT_HILASTAUTO .
366 This is adjustable through the sysctl setting:
367 .Va net.inet.ip.portrange.hifirst
369 .Va net.inet.ip.portrange.hilast .
370 .It Dv IP_PORTRANGE_LOW
371 use a low range of ports, which are normally restricted to
372 privileged processes on
375 The range is normally from
378 .Li IPPORT_RESERVEDSTART
380 This is adjustable through the sysctl setting:
381 .Va net.inet.ip.portrange.lowfirst
383 .Va net.inet.ip.portrange.lowlast .
386 The range of privileged ports which only may be opened by
387 root-owned processes may be modified by the
388 .Va net.inet.ip.portrange.reservedlow
390 .Va net.inet.ip.portrange.reservedhigh
392 The values default to the traditional range,
396 (0 through 1023), respectively.
397 Note that these settings do not affect and are not accounted for in the
398 use or calculation of the other
399 .Va net.inet.ip.portrange
401 Changing these values departs from
403 tradition and has security
404 consequences that the administrator should carefully evaluate before
405 modifying these settings.
407 Ports are allocated at random within the specified port range in order
408 to increase the difficulty of random spoofing attacks.
409 In scenarios such as benchmarking, this behavior may be undesirable.
411 .Va net.inet.ip.portrange.randomized
412 can be used to toggle randomization off.
414 .Va net.inet.ip.portrange.randomcps
415 ports have been allocated in the last second, then return to sequential
417 Return to random allocation only once the current port allocation rate
419 .Va net.inet.ip.portrange.randomcps
421 .Va net.inet.ip.portrange.randomtime
423 The default values for
424 .Va net.inet.ip.portrange.randomcps
426 .Va net.inet.ip.portrange.randomtime
427 are 10 port allocations per second and 45 seconds correspondingly.
428 .Ss "Multicast Options"
430 multicasting is supported only on
436 and only on networks where the interface
437 driver supports multicasting.
441 option changes the time-to-live (TTL)
442 for outgoing multicast datagrams
443 in order to control the scope of the multicasts:
445 u_char ttl; /* range: 0 to 255, default = 1 */
446 setsockopt(s, IPPROTO_IP, IP_MULTICAST_TTL, &ttl, sizeof(ttl));
449 Datagrams with a TTL of 1 are not forwarded beyond the local network.
450 Multicast datagrams with a TTL of 0 will not be transmitted on any network,
451 but may be delivered locally if the sending host belongs to the destination
452 group and if multicast loopback has not been disabled on the sending socket
454 Multicast datagrams with TTL greater than 1 may be forwarded
455 to other networks if a multicast router is attached to the local network.
457 For hosts with multiple interfaces, where an interface has not
458 been specified for a multicast group membership,
459 each multicast transmission is sent from the primary network interface.
462 option overrides the default for
463 subsequent transmissions from a given socket:
466 setsockopt(s, IPPROTO_IP, IP_MULTICAST_IF, &addr, sizeof(addr));
469 where "addr" is the local
471 address of the desired interface or
473 to specify the default interface.
475 To specify an interface by index, an instance of
477 may be passed instead.
480 member should be set to the index of the desired interface,
481 or 0 to specify the default interface.
482 The kernel differentiates between these two structures by their size.
487 .Em not recommended ,
488 as multicast memberships are scoped to each
489 individual interface.
490 It is supported for legacy use only by applications,
491 such as routing daemons, which expect to
492 be able to transmit link-local IPv4 multicast datagrams (224.0.0.0/24)
493 on multiple interfaces,
494 without requesting an individual membership for each interface.
497 An interface's local IP address and multicast capability can
503 Normal applications should not need to use this option.
505 If a multicast datagram is sent to a group to which the sending host itself
506 belongs (on the outgoing interface), a copy of the datagram is, by default,
507 looped back by the IP layer for local delivery.
509 .Dv IP_MULTICAST_LOOP
510 option gives the sender explicit control
511 over whether or not subsequent datagrams are looped back:
513 u_char loop; /* 0 = disable, 1 = enable (default) */
514 setsockopt(s, IPPROTO_IP, IP_MULTICAST_LOOP, &loop, sizeof(loop));
518 improves performance for applications that may have no more than one
519 instance on a single host (such as a routing daemon), by eliminating
520 the overhead of receiving their own transmissions.
521 It should generally not
522 be used by applications for which there may be more than one instance on a
523 single host (such as a conferencing program) or for which the sender does
524 not belong to the destination group (such as a time querying program).
527 .Va net.inet.ip.mcast.loop
528 controls the default setting of the
529 .Dv IP_MULTICAST_LOOP
530 socket option for new sockets.
532 A multicast datagram sent with an initial TTL greater than 1 may be delivered
533 to the sending host on a different interface from that on which it was sent,
534 if the host belongs to the destination group on that other interface.
535 The loopback control option has no effect on such delivery.
537 A host must become a member of a multicast group before it can receive
538 datagrams sent to the group.
539 To join a multicast group, use the
540 .Dv IP_ADD_MEMBERSHIP
544 setsockopt(s, IPPROTO_IP, IP_ADD_MEMBERSHIP, &mreq, sizeof(mreq));
549 is the following structure:
552 struct in_addr imr_multiaddr; /* IP multicast address of group */
553 struct in_addr imr_interface; /* local IP address of interface */
560 address of a particular multicast-capable interface if
561 the host is multihomed.
564 to choose the default interface, although this is not recommended;
565 this is considered to be the first interface corresponding
566 to the default route.
567 Otherwise, the first multicast-capable interface
568 configured in the system will be used.
574 member is within the network range
576 it is treated as an interface index in the system interface MIB,
577 as per the RIP Version 2 MIB Extension (RFC-1724).
580 since 7.0, this behavior is no longer supported.
582 instead use the RFC 3678 multicast source filter APIs; in particular,
583 .Dv MCAST_JOIN_GROUP .
586 .Dv IP_MAX_MEMBERSHIPS
587 memberships may be added on a single socket.
588 Membership is associated with a single interface;
589 programs running on multihomed hosts may need to
590 join the same group on more than one interface.
592 To drop a membership, use:
595 setsockopt(s, IPPROTO_IP, IP_DROP_MEMBERSHIP, &mreq, sizeof(mreq));
600 contains the same values as used to add the membership.
601 Memberships are dropped when the socket is closed or the process exits.
602 .\" TODO: Update this piece when IPv4 source-address selection is implemented.
604 The IGMP protocol uses the primary IP address of the interface
605 as its identifier for group membership.
606 This is the first IP address configured on the interface.
607 If this address is removed or changed, the results are
608 undefined, as the IGMP membership state will then be inconsistent.
609 If multiple IP aliases are configured on the same interface,
610 they will be ignored.
612 This shortcoming was addressed in IPv6; MLDv2 requires
613 that the unique link-local address for an interface is
614 used to identify an MLDv2 listener.
615 .Ss "Source-Specific Multicast Options"
618 the use of Source-Specific Multicast (SSM) is supported.
619 These extensions require an IGMPv3 multicast router in order to
620 make best use of them.
621 If a legacy multicast router is present on the link,
623 will simply downgrade to the version of IGMP spoken by the router,
624 and the benefits of source filtering on the upstream link
625 will not be present, although the kernel will continue to
626 squelch transmissions from blocked sources.
628 Each group membership on a socket now has a filter mode:
629 .Bl -tag -width MCAST_EXCLUDE
631 Datagrams sent to this group are accepted,
632 unless the source is in a list of blocked source addresses.
634 Datagrams sent to this group are accepted
635 only if the source is in a list of accepted source addresses.
638 Groups joined using the legacy
639 .Dv IP_ADD_MEMBERSHIP
640 option are placed in exclusive-mode,
641 and are able to request that certain sources are blocked or allowed.
643 .Em delta-based API .
645 To block a multicast source on an existing group membership:
647 struct ip_mreq_source mreqs;
648 setsockopt(s, IPPROTO_IP, IP_BLOCK_SOURCE, &mreqs, sizeof(mreqs));
653 is the following structure:
655 struct ip_mreq_source {
656 struct in_addr imr_multiaddr; /* IP multicast address of group */
657 struct in_addr imr_sourceaddr; /* IP address of source */
658 struct in_addr imr_interface; /* local IP address of interface */
662 should be set to the address of the source to be blocked.
664 To unblock a multicast source on an existing group:
666 struct ip_mreq_source mreqs;
667 setsockopt(s, IPPROTO_IP, IP_UNBLOCK_SOURCE, &mreqs, sizeof(mreqs));
673 .Dv IP_UNBLOCK_SOURCE
676 for inclusive-mode group memberships.
678 To join a multicast group in
680 mode with a single source,
681 or add another source to an existing inclusive-mode membership:
683 struct ip_mreq_source mreqs;
684 setsockopt(s, IPPROTO_IP, IP_ADD_SOURCE_MEMBERSHIP, &mreqs, sizeof(mreqs));
687 To leave a single source from an existing group in inclusive mode:
689 struct ip_mreq_source mreqs;
690 setsockopt(s, IPPROTO_IP, IP_DROP_SOURCE_MEMBERSHIP, &mreqs, sizeof(mreqs));
692 If this is the last accepted source for the group, the membership
696 .Dv IP_ADD_SOURCE_MEMBERSHIP
698 .Dv IP_DROP_SOURCE_MEMBERSHIP
701 for exclusive-mode group memberships.
702 However, both exclusive and inclusive mode memberships
703 support the use of the
705 documented in RFC 3678.
706 For management of source filter lists using this API,
711 .Va net.inet.ip.mcast.maxsocksrc
713 .Va net.inet.ip.mcast.maxgrpsrc
714 are used to specify an upper limit on the number of per-socket and per-group
715 source filter entries which the kernel may allocate.
716 .\"-----------------------
720 sockets are connectionless,
721 and are normally used with the
727 call may also be used to fix the destination for future
728 packets (in which case the
736 system calls may be used).
740 is 0, the default protocol
743 packets, and only incoming packets destined for that protocol
747 is non-zero, that protocol number will be used on outgoing packets
748 and to filter incoming packets.
750 Outgoing packets automatically have an
753 them (based on the destination address and the protocol
754 number the socket is created with),
760 releases, incoming packets are received with
762 header and options intact, leaving all fields in network byte order.
765 indicates the complete IP header is included with the data
766 and may be used only with the
770 #include <netinet/in_systm.h>
771 #include <netinet/ip.h>
773 int hincl = 1; /* 1 = on, 0 = off */
774 setsockopt(s, IPPROTO_IP, IP_HDRINCL, &hincl, sizeof(hincl));
779 releases, the program must set all
780 the fields of the IP header, including the following:
782 ip->ip_v = IPVERSION;
783 ip->ip_hl = hlen >> 2;
784 ip->ip_id = 0; /* 0 means kernel set appropriate value */
785 ip->ip_off = htons(offset);
786 ip->ip_len = htons(len);
789 The packet should be provided as is to be sent over wire.
790 This implies all fields, including
794 to be in network byte order.
797 for more information on network byte order.
800 field is set to 0 then the kernel will choose an
802 If the header source address is set to
804 the kernel will choose an appropriate address.
806 A socket operation may fail with one of the following errors returned:
809 when trying to establish a connection on a socket which
810 already has one, or when trying to send a datagram with the destination
811 address specified and the socket is already connected;
813 when trying to send a datagram, but
814 no destination address is specified, and the socket has not been
817 when the system runs out of memory for
818 an internal data structure;
819 .It Bq Er EADDRNOTAVAIL
820 when an attempt is made to create a
821 socket with a network address for which no network interface
824 when an attempt is made to create
825 a raw IP socket by a non-privileged process.
828 The following errors specific to
830 may occur when setting or getting
835 An unknown socket option name was given.
837 The IP option field was improperly formed;
838 an option field was shorter than the minimum value
839 or longer than the option buffer provided.
842 The following errors may occur when attempting to send
853 field was not equal to the length of the datagram written to the socket.
870 .%T "Socket Interface Extensions for Multicast Source Filters"
881 structure appeared in
886 packets received on raw IP sockets had the
894 packets received on raw IP sockets had the
898 fields converted to host byte order.
899 Packets written to raw IP sockets were expected to have
projects / FreeBSD / FreeBSD.git / blob