[removed linix-kernel in CC] SIOCADDMULTI is how you join an IP level multicast group (IP Class D addresses 224.0.0.0-239.255.255). For lower layer traffic, you'll have to use BPF or something like it. Since your host likely won't have that Ethernet multicast address in its NIC filter, you'll also want to put the interface in promiscuous mode. Also, the 3rd argument for SIOCADDMULTI ioctl's is either an ip_mreq or ip_mreqn, not an ifreq. +-DLS Im trying to grab some ethernet multicasts. And the ioctl that should do that is SIOCADDMULTI. But I can't get it to work. And I have not found any who use that from userlevel so this is my guess who to do it. (I don't work but dont gives any error message) #include <stdio.h> #include <sys/ioctl.h> #include <net/if.h> #include <arpa/inet.h> #include <errno.h> #include <sys/un.h> int main() { int i,res,sock,from_len; struct sockaddr_in eb_addr,from_addr; char databuf[1500]; struct ifreq req; if((sock = socket(AF_INET, SOCK_DGRAM, 0)) == -1) { printf("%s",strerror(errno)); exit(1); } eb_addr.sin_family = AF_INET; /* eb_addr.sin_family = AF_UNSPEC; */ eb_addr.sin_addr.s_addr = inet_addr("0.0.0.0"); eb_addr.sin_port = htons(4711); for (i = 0; i < 8; ++i) eb_addr.sin_zero[i] = 0; if(bind(sock,(struct sockaddr*) &eb_addr, sizeof(struct sockaddr_in)) == -1) { printf("Unable to bind the socket\n"); exit(1); } strcpy(req.ifr_name,"eth0"); req.ifr_ifru.ifru_addr.sa_data[0] = 0x01; req.ifr_ifru.ifru_addr.sa_data[1] = 0x80; req.ifr_ifru.ifru_addr.sa_data[2] = 0xc2; req.ifr_ifru.ifru_addr.sa_data[3] = 0x00; req.ifr_ifru.ifru_addr.sa_data[4] = 0x00; req.ifr_ifru.ifru_addr.sa_data[5] = 0x00; /* req.ifr_flags = IFF_ALLMULTI; | IFF_PROMISC; */ res = ioctl(sock,SIOCADDMULTI,&req); if(res == -1) { printf("%s",strerror(errno)); exit(1); } while (1) { printf("enter recvfrom\n"); res = recvfrom(sock, databuf, sizeof(databuf), 0,(struct sockaddr*) &from_addr, &from_len); printf("Received %d bytes\n", res ); } return 0; } This on a 2.4.9 kernel on SMP P2. Im trying to grab some 802 bridge packets and I see them with tcpdump but that is using a other interface. (BPF or what ever) Any ideas whats wrong ? - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html