Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm working on a TCP/IP implementation, for an embedded device, that I want to test from a Linux user space process using raw sockets.

raw(7) says that

Raw sockets may tap all IP protocols in Linux, even protocols like ICMP or TCP which have a protocol module in the kernel. In this case, the packets are passed to both the kernel module and the raw socket(s).

I need to disable this kernel processing (at least on a specific destination port) in order to test my implementation. I think there's some manipulation involving iptables which can do this, but frankly I'm no Linux guru. I appreciate any help.

share|improve this question
Have you tried what it is you're trying to do without making any changes? My experience is that raw sockets are raw sockets. It may cook the data when accessing it via a specific protocol, but if you're dealing explicitly with raw sockets, you should be fine. –  wfaulk May 8 '12 at 21:34
You may have an easier time creating iptables rules to block the reply traffic that the kernel generates than creating iptables rules to block the kernel from seeing them in the first place while still allowing your raw socket to see them. The effect would be the same except that the kernel would do some processing for nothing. I haven't tried this though, so YMMV. –  Celada May 8 '12 at 21:44
wfaulk -- if I receive e.g. a SYN on the port of interest, the kernel stack will respond to it and screw up my implementation's handshake. Is there an iptables parameter for kernel generated packets? –  Peter Woo May 8 '12 at 22:17
all the packets on output chain are kernel generated, but this includes the packets your app is sending. –  DukeLion Aug 9 '13 at 13:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.