Raw socket behavior

I've been playing around with raw sockets (kernel 2.4.18, debian
woody) and I'm a little confused about how I should be reading from
them.

I'm aware that libpcap might be a better alternative to using raw
sockets, I'm probably going to end up using that, but just out of
curiosity ...

I'm doing something like this -

sockfd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP);
rc = recvfrom (sockfd, buffer, 1024, 0, NULL, NULL);

As far as I'm aware, I should be prepared for 'parts' of IP packets to
be delivered through the socket, but this never seems to happen, i.e.
I always get one and only one packet per call to recv. Whats more, if
the buffer passed to recv is smaller than the IP packet length, the
remainder of the packet seems to be discarded - I was expecting the
rest of it in the next call to recv.

Am I safe to just assume one packet per recv and use a big enough
buffer ?

Dan

Dan Wilson wrote:
> Am I safe to just assume one packet per recv and use a big enough
> buffer ?

You should at least set the buffer size to
MTU == 1500 on Ethernet
See 'ifconfig' for actual size on eth0 or ...

No IP packet will (receive) or must not (send) be bigger
than the MTU (message transfer unit) size on the specific
interface.

Toni