1 .\" Copyright (c) 1983, 1991, 1993
2 .\" The Regents of the University of California. All rights reserved.
4 .\" Redistribution and use in source and binary forms, with or without
5 .\" modification, are permitted provided that the following conditions
7 .\" 1. Redistributions of source code must retain the above copyright
8 .\" notice, this list of conditions and the following disclaimer.
9 .\" 2. Redistributions in binary form must reproduce the above copyright
10 .\" notice, this list of conditions and the following disclaimer in the
11 .\" documentation and/or other materials provided with the distribution.
12 .\" 3. All advertising materials mentioning features or use of this software
13 .\" must display the following acknowledgement:
14 .\" This product includes software developed by the University of
15 .\" California, Berkeley and its contributors.
16 .\" 4. Neither the name of the University nor the names of its contributors
17 .\" may be used to endorse or promote products derived from this software
18 .\" without specific prior written permission.
20 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 .\" @(#)ip.4 8.2 (Berkeley) 11/30/93
46 .Fn socket AF_INET SOCK_RAW proto
49 is the transport layer protocol used
50 by the Internet protocol family.
51 Options may be set at the
54 when using higher-level protocols that are based on
60 It may also be accessed
63 when developing new protocols, or
64 special-purpose applications.
73 may be used to provide
75 options to be transmitted in the
77 header of each outgoing packet
78 or to examine the header options on incoming packets.
80 options may be used with any socket type in the Internet family.
83 options to be sent is that specified by the
85 protocol specification (RFC-791), with one exception:
86 the list of addresses for Source Route options must include the first-hop
87 gateway at the beginning of the list of gateways.
88 The first-hop gateway address will be extracted from the option list
89 and the size adjusted accordingly before use.
90 To disable previously specified options,
91 use a zero-length buffer:
93 setsockopt(s, IPPROTO_IP, IP_OPTIONS, NULL, 0);
99 may be used to set the type-of-service and time-to-live
103 .Dv SOCK_STREAM , SOCK_DGRAM ,
109 int tos = IPTOS_LOWDELAY; /* see <netinet/ip.h> */
110 setsockopt(s, IPPROTO_IP, IP_TOS, &tos, sizeof(tos));
112 int ttl = 60; /* max = 255 */
113 setsockopt(s, IPPROTO_IP, IP_TTL, &ttl, sizeof(ttl));
117 may be used to set the minimum acceptable TTL a packet must have when
118 received on a socket.
119 All packets with a lower TTL are silently dropped.
120 This option is only really useful when set to 255, preventing packets
121 from outside the directly connected networks reaching local listeners
125 may be used to set the Don't Fragment flag on IP packets.
126 Currently this option is respected only on
135 sockets, the Don't Fragment flag is controlled by the Path
136 MTU Discovery option.
137 Sending a packet larger than the MTU size of the egress interface,
138 determined by the destination address, returns an
144 option is enabled on a
149 call will return the destination
158 structure points to a buffer
161 structure followed by the
166 fields have the following values:
168 cmsg_len = sizeof(struct in_addr)
169 cmsg_level = IPPROTO_IP
170 cmsg_type = IP_RECVDSTADDR
173 The source address to be used for outgoing
175 datagrams on a socket that is not bound to a specific
177 address can be specified as ancillary data with a type code of
179 The msg_control field in the msghdr structure should point to a buffer
182 structure followed by the
185 The cmsghdr fields should have the following values:
187 cmsg_len = sizeof(struct in_addr)
188 cmsg_level = IPPROTO_IP
189 cmsg_type = IP_SENDSRCADDR
194 is defined to have the same value as
200 can be used directly as a control message for
206 option is enabled on a
210 socket, the destination address of outgoing
211 broadcast datagrams on that socket will be forced
212 to the undirected broadcast address,
213 .Dv INADDR_BROADCAST ,
215 This is in contrast to the default behavior of the
216 system, which is to transmit undirected broadcasts
217 via the first network interface with the
218 .Dv IFF_BROADCAST flag set.
220 This option allows applications to choose which
221 interface is used to transmit an undirected broadcast
223 For example, the following code would force an
224 undirected broadcast to be transmitted via the interface
225 configured with the broadcast address 192.168.2.255:
228 struct sockaddr_in sin;
229 u_char onesbcast = 1; /* 0 = disable (default), 1 = enable */
231 setsockopt(s, IPPROTO_IP, IP_ONESBCAST, &onesbcast, sizeof(onesbcast));
232 sin.sin_addr.s_addr = inet_addr("192.168.2.255");
233 sin.sin_port = htons(1234);
234 sendto(s, msg, sizeof(msg), 0, &sin, sizeof(sin));
237 It is the application's responsibility to set the
239 to an appropriate value in order to prevent broadcast storms.
240 The application must have sufficient credentials to set the
242 socket level option, otherwise the
243 .Dv IP_ONESBCAST option has no effect.
247 option is enabled on a
254 to any address, even one not bound to any available network interface in the
256 This functionality (in conjunction with special firewall rules) can be used for
257 implementing a transparent proxy.
259 .Dv PRIV_NETINET_BINDANY
260 privilege is needed to set this option.
264 option is enabled on a
271 (time to live) field for a
274 The msg_control field in the msghdr structure points to a buffer
275 that contains a cmsghdr structure followed by the
277 The cmsghdr fields have the following values:
279 cmsg_len = sizeof(u_char)
280 cmsg_level = IPPROTO_IP
281 cmsg_type = IP_RECVTTL
287 option is enabled on a
292 .Vt "struct sockaddr_dl"
293 corresponding to the interface on which the
299 structure points to a buffer that contains a
301 structure followed by the
302 .Vt "struct sockaddr_dl" .
305 fields have the following values:
307 cmsg_len = sizeof(struct sockaddr_dl)
308 cmsg_level = IPPROTO_IP
309 cmsg_type = IP_RECVIF
313 may be used to set the port range used for selecting a local port number
314 on a socket with an unspecified (zero) port number.
317 .Bl -tag -width IP_PORTRANGE_DEFAULT
318 .It Dv IP_PORTRANGE_DEFAULT
319 use the default range of values, normally
320 .Dv IPPORT_HIFIRSTAUTO
322 .Dv IPPORT_HILASTAUTO .
323 This is adjustable through the sysctl setting:
324 .Va net.inet.ip.portrange.first
326 .Va net.inet.ip.portrange.last .
327 .It Dv IP_PORTRANGE_HIGH
328 use a high range of values, normally
329 .Dv IPPORT_HIFIRSTAUTO
331 .Dv IPPORT_HILASTAUTO .
332 This is adjustable through the sysctl setting:
333 .Va net.inet.ip.portrange.hifirst
335 .Va net.inet.ip.portrange.hilast .
336 .It Dv IP_PORTRANGE_LOW
337 use a low range of ports, which are normally restricted to
338 privileged processes on
341 The range is normally from
344 .Li IPPORT_RESERVEDSTART
346 This is adjustable through the sysctl setting:
347 .Va net.inet.ip.portrange.lowfirst
349 .Va net.inet.ip.portrange.lowlast .
352 The range of privileged ports which only may be opened by
353 root-owned processes may be modified by the
354 .Va net.inet.ip.portrange.reservedlow
356 .Va net.inet.ip.portrange.reservedhigh
358 The values default to the traditional range,
362 (0 through 1023), respectively.
363 Note that these settings do not affect and are not accounted for in the
364 use or calculation of the other
365 .Va net.inet.ip.portrange
367 Changing these values departs from
369 tradition and has security
370 consequences that the administrator should carefully evaluate before
371 modifying these settings.
373 Ports are allocated at random within the specified port range in order
374 to increase the difficulty of random spoofing attacks.
375 In scenarios such as benchmarking, this behavior may be undesirable.
377 .Va net.inet.ip.portrange.randomized
378 can be used to toggle randomization off.
380 .Va net.inet.ip.portrange.randomcps
381 ports have been allocated in the last second, then return to sequential
383 Return to random allocation only once the current port allocation rate
385 .Va net.inet.ip.portrange.randomcps
387 .Va net.inet.ip.portrange.randomtime
389 The default values for
390 .Va net.inet.ip.portrange.randomcps
392 .Va net.inet.ip.portrange.randomtime
393 are 10 port allocations per second and 45 seconds correspondingly.
394 .Ss "Multicast Options"
397 multicasting is supported only on
403 and only on networks where the interface
404 driver supports multicasting.
408 option changes the time-to-live (TTL)
409 for outgoing multicast datagrams
410 in order to control the scope of the multicasts:
412 u_char ttl; /* range: 0 to 255, default = 1 */
413 setsockopt(s, IPPROTO_IP, IP_MULTICAST_TTL, &ttl, sizeof(ttl));
416 Datagrams with a TTL of 1 are not forwarded beyond the local network.
417 Multicast datagrams with a TTL of 0 will not be transmitted on any network,
418 but may be delivered locally if the sending host belongs to the destination
419 group and if multicast loopback has not been disabled on the sending socket
421 Multicast datagrams with TTL greater than 1 may be forwarded
422 to other networks if a multicast router is attached to the local network.
424 For hosts with multiple interfaces, where an interface has not
425 been specified for a multicast group membership,
426 each multicast transmission is sent from the primary network interface.
429 option overrides the default for
430 subsequent transmissions from a given socket:
433 setsockopt(s, IPPROTO_IP, IP_MULTICAST_IF, &addr, sizeof(addr));
436 where "addr" is the local
438 address of the desired interface or
440 to specify the default interface.
442 To specify an interface by index, an instance of
444 may be passed instead.
447 member should be set to the index of the desired interface,
448 or 0 to specify the default interface.
449 The kernel differentiates between these two structures by their size.
454 .Em not recommended ,
455 as multicast memberships are scoped to each
456 individual interface.
457 It is supported for legacy use only by applications,
458 such as routing daemons, which expect to
459 be able to transmit link-local IPv4 multicast datagrams (224.0.0.0/24)
460 on multiple interfaces,
461 without requesting an individual membership for each interface.
464 An interface's local IP address and multicast capability can
470 Normal applications should not need to use this option.
472 If a multicast datagram is sent to a group to which the sending host itself
473 belongs (on the outgoing interface), a copy of the datagram is, by default,
474 looped back by the IP layer for local delivery.
476 .Dv IP_MULTICAST_LOOP
477 option gives the sender explicit control
478 over whether or not subsequent datagrams are looped back:
480 u_char loop; /* 0 = disable, 1 = enable (default) */
481 setsockopt(s, IPPROTO_IP, IP_MULTICAST_LOOP, &loop, sizeof(loop));
485 improves performance for applications that may have no more than one
486 instance on a single host (such as a routing daemon), by eliminating
487 the overhead of receiving their own transmissions.
488 It should generally not
489 be used by applications for which there may be more than one instance on a
490 single host (such as a conferencing program) or for which the sender does
491 not belong to the destination group (such as a time querying program).
494 .Va net.inet.ip.mcast.loop
495 controls the default setting of the
496 .Dv IP_MULTICAST_LOOP
497 socket option for new sockets.
499 A multicast datagram sent with an initial TTL greater than 1 may be delivered
500 to the sending host on a different interface from that on which it was sent,
501 if the host belongs to the destination group on that other interface.
502 The loopback control option has no effect on such delivery.
504 A host must become a member of a multicast group before it can receive
505 datagrams sent to the group.
506 To join a multicast group, use the
507 .Dv IP_ADD_MEMBERSHIP
511 setsockopt(s, IPPROTO_IP, IP_ADD_MEMBERSHIP, &mreq, sizeof(mreq));
516 is the following structure:
519 struct in_addr imr_multiaddr; /* IP multicast address of group */
520 struct in_addr imr_interface; /* local IP address of interface */
527 address of a particular multicast-capable interface if
528 the host is multihomed.
531 to choose the default interface, although this is not recommended;
532 this is considered to be the first interface corresponding
533 to the default route.
534 Otherwise, the first multicast-capable interface
535 configured in the system will be used.
541 member is within the network range
543 it is treated as an interface index in the system interface MIB,
544 as per the RIP Version 2 MIB Extension (RFC-1724).
547 since 7.0, this behavior is no longer supported.
549 instead use the RFC 3678 multicast source filter APIs; in particular,
550 .Dv MCAST_JOIN_GROUP .
553 .Dv IP_MAX_MEMBERSHIPS
554 memberships may be added on a single socket.
555 Membership is associated with a single interface;
556 programs running on multihomed hosts may need to
557 join the same group on more than one interface.
559 To drop a membership, use:
562 setsockopt(s, IPPROTO_IP, IP_DROP_MEMBERSHIP, &mreq, sizeof(mreq));
567 contains the same values as used to add the membership.
568 Memberships are dropped when the socket is closed or the process exits.
569 .\" TODO: Update this piece when IPv4 source-address selection is implemented.
571 The IGMP protocol uses the primary IP address of the interface
572 as its identifier for group membership.
573 This is the first IP address configured on the interface.
574 If this address is removed or changed, the results are
575 undefined, as the IGMP membership state will then be inconsistent.
576 If multiple IP aliases are configured on the same interface,
577 they will be ignored.
579 This shortcoming was addressed in IPv6; MLDv2 requires
580 that the unique link-local address for an interface is
581 used to identify an MLDv2 listener.
582 .Ss "Source-Specific Multicast Options"
585 the use of Source-Specific Multicast (SSM) is supported.
586 These extensions require an IGMPv3 multicast router in order to
587 make best use of them.
588 If a legacy multicast router is present on the link,
590 will simply downgrade to the version of IGMP spoken by the router,
591 and the benefits of source filtering on the upstream link
592 will not be present, although the kernel will continue to
593 squelch transmissions from blocked sources.
595 Each group membership on a socket now has a filter mode:
596 .Bl -tag -width MCAST_EXCLUDE
598 Datagrams sent to this group are accepted,
599 unless the source is in a list of blocked source addresses.
601 Datagrams sent to this group are accepted
602 only if the source is in a list of accepted source addresses.
605 Groups joined using the legacy
606 .Dv IP_ADD_MEMBERSHIP
607 option are placed in exclusive-mode,
608 and are able to request that certain sources are blocked or allowed.
610 .Em delta-based API .
612 To block a multicast source on an existing group membership:
614 struct ip_mreq_source mreqs;
615 setsockopt(s, IPPROTO_IP, IP_BLOCK_SOURCE, &mreqs, sizeof(mreqs));
620 is the following structure:
622 struct ip_mreq_source {
623 struct in_addr imr_multiaddr; /* IP multicast address of group */
624 struct in_addr imr_sourceaddr; /* IP address of source */
625 struct in_addr imr_interface; /* local IP address of interface */
629 should be set to the address of the source to be blocked.
631 To unblock a multicast source on an existing group:
633 struct ip_mreq_source mreqs;
634 setsockopt(s, IPPROTO_IP, IP_UNBLOCK_SOURCE, &mreqs, sizeof(mreqs));
640 .Dv IP_UNBLOCK_SOURCE
643 for inclusive-mode group memberships.
645 To join a multicast group in
647 mode with a single source,
648 or add another source to an existing inclusive-mode membership:
650 struct ip_mreq_source mreqs;
651 setsockopt(s, IPPROTO_IP, IP_ADD_SOURCE_MEMBERSHIP, &mreqs, sizeof(mreqs));
654 To leave a single source from an existing group in inclusive mode:
656 struct ip_mreq_source mreqs;
657 setsockopt(s, IPPROTO_IP, IP_DROP_SOURCE_MEMBERSHIP, &mreqs, sizeof(mreqs));
659 If this is the last accepted source for the group, the membership
663 .Dv IP_ADD_SOURCE_MEMBERSHIP
665 .Dv IP_DROP_SOURCE_MEMBERSHIP
668 for exclusive-mode group memberships.
669 However, both exclusive and inclusive mode memberships
670 support the use of the
672 documented in RFC 3678.
673 For management of source filter lists using this API,
678 .Va net.inet.ip.mcast.maxsocksrc
680 .Va net.inet.ip.mcast.maxgrpsrc
681 are used to specify an upper limit on the number of per-socket and per-group
682 source filter entries which the kernel may allocate.
683 .\"-----------------------
688 sockets are connectionless,
689 and are normally used with the
695 call may also be used to fix the destination for future
696 packets (in which case the
704 system calls may be used).
708 is 0, the default protocol
711 packets, and only incoming packets destined for that protocol
715 is non-zero, that protocol number will be used on outgoing packets
716 and to filter incoming packets.
718 Outgoing packets automatically have an
721 them (based on the destination address and the protocol
722 number the socket is created with),
726 Incoming packets are received with
728 header and options intact.
731 indicates the complete IP header is included with the data
732 and may be used only with the
736 #include <netinet/in_systm.h>
737 #include <netinet/ip.h>
739 int hincl = 1; /* 1 = on, 0 = off */
740 setsockopt(s, IPPROTO_IP, IP_HDRINCL, &hincl, sizeof(hincl));
745 releases, the program must set all
746 the fields of the IP header, including the following:
748 ip->ip_v = IPVERSION;
749 ip->ip_hl = hlen >> 2;
750 ip->ip_id = 0; /* 0 means kernel set appropriate value */
760 be provided in host byte order .
761 All other fields must be provided in network byte order.
764 for more information on network byte order.
767 field is set to 0 then the kernel will choose an
769 If the header source address is set to
771 the kernel will choose an appropriate address.
773 A socket operation may fail with one of the following errors returned:
776 when trying to establish a connection on a socket which
777 already has one, or when trying to send a datagram with the destination
778 address specified and the socket is already connected;
780 when trying to send a datagram, but
781 no destination address is specified, and the socket has not been
784 when the system runs out of memory for
785 an internal data structure;
786 .It Bq Er EADDRNOTAVAIL
787 when an attempt is made to create a
788 socket with a network address for which no network interface
791 when an attempt is made to create
792 a raw IP socket by a non-privileged process.
795 The following errors specific to
797 may occur when setting or getting
802 An unknown socket option name was given.
804 The IP option field was improperly formed;
805 an option field was shorter than the minimum value
806 or longer than the option buffer provided.
809 The following errors may occur when attempting to send
820 field was not equal to the length of the datagram written to the socket.
837 .%T "Socket Interface Extensions for Multicast Source Filters"
848 structure appeared in