C sockets: Can a raw socket receive more than one ethernet frame in the buffer?

Viewed 19

I've been recently learning about the concept of raw sockets and their uses, and I'm trying to build a simple packet sniffer. In an explanation I've came across, the buffer size used to receive the data is an arbitrary number (65536 bytes). Can there be more than one ethernet frame in one buffer? And if I got it all wrong can you please explain why and how to make use of the raw sockets and intended? Here is some of the code:

int sock_r;
sock_r=socket(PF_PACKET,SOCK_RAW,htons(ETH_P_ALL));

unsigned char *buffer = (unsigned char *) malloc(65536);
memset(buffer,0,65536);
struct sockaddr saddr;
int saddr_len = sizeof (saddr);
int buflen = recvfrom(sock_r, buffer, 65536, 0, &saddr,(socklen_t *)&saddr_len);

Thank you.

0 Answers
Related