--- name: "ng_socket" section: "4" platform: "freebsd" package: "base" version: "16.0-CURRENT-20261027-61c70dc16a79" release: "FreeBSD 16.0-CURRENT (2026-10-27)" platforms: ["linux", "freebsd"] url: "https://new.carta.tech/ng_socket" --- # ng\_socket(4) socket interface netgraph node ## NAME **ng\_socket** – socket interface netgraph node ## SYNOPSIS **#include \** **#include \** ## DESCRIPTION A **socket** node is both a BSD socket and a netgraph node. The **ng\_socket** node type allows user-mode processes to participate in the kernel [netgraph(4)](/netgraph/4.md) networking subsystem using the BSD socket interface. The process must have root privileges to be able to create netgraph sockets however once created, any process that has one may use it. A new **ng\_socket** node is created by creating a new socket of type NG\_CONTROL in the protocol family PF\_NETGRAPH, using the [socket(2)](/socket/2.md) system call. Any control messages received by the node and not having a cookie value of NGM\_SOCKET\_COOKIE are received by the process, using [recvfrom(2)](/recvfrom/2.md); the socket address argument is a struct sockaddr\_ng containing the sender's netgraph address. Conversely, control messages can be sent to any node by calling [sendto(2)](/sendto/2.md), supplying the recipient's address in a struct sockaddr\_ng. The [bind(2)](/bind/2.md) system call may be used to assign a global netgraph name to the node. To transmit and receive netgraph data packets, a NG\_DATA socket must also be created using [socket(2)](/socket/2.md) and associated with a **ng\_socket** node. NG\_DATA sockets do not automatically have nodes associated with them; they are bound to a specific node via the [connect(2)](/connect/2.md) system call. The address argument is the netgraph address of the **ng\_socket** node already created. Once a data socket is associated with a node, any data packets received by the node are read using [recvfrom(2)](/recvfrom/2.md) and any packets to be sent out from the node are written using [sendto(2)](/sendto/2.md). In the case of data sockets, the struct sockaddr\_ng contains the name of the *hook* on which the data was received or should be sent. As a special case, to allow netgraph data sockets to be used as stdin or stdout on naive programs, a [sendto(2)](/sendto/2.md) with a NULL sockaddr pointer, a [send(2)](/send/2.md) or a [write(2)](/write/2.md) will succeed in the case where there is exactly ONE hook attached to the socket node, (and thus the path is unambiguous). There is a user library that simplifies using netgraph sockets; see [netgraph(3)](/netgraph/3.md). ## HOOKS This node type supports hooks with arbitrary names (as long as they are unique) and always accepts hook connection requests. ## CONTROL MESSAGES This node type supports the generic control messages, plus the following: - NGM\_SOCK\_CMD\_NOLINGER When the last hook is removed from this node, it will shut down as if it had received a NGM\_SHUTDOWN message. Attempts to access the sockets associated will return ENOTCONN. - NGM\_SOCK\_CMD\_LINGER This is the default mode. When the last hook is removed, the node will continue to exist, ready to accept new hooks until it is explicitly shut down. All other messages with neither the NGM\_SOCKET\_COOKIE or NGM\_GENERIC\_COOKIE will be passed unaltered up the NG\_CONTROL socket. ## SHUTDOWN This node type shuts down and disappears when both the associated NG\_CONTROL and NG\_DATA sockets have been closed, or a NGM\_SHUTDOWN control message is received. In the latter case, attempts to write to the still-open sockets will return ENOTCONN. If the NGM\_SOCK\_CMD\_NOLINGER message has been received, closure of the last hook will also initiate a shutdown of the node. ## SEE ALSO [socket(2)](/socket/2.md), [netgraph(3)](/netgraph/3.md), [netgraph(4)](/netgraph/4.md), [ng\_ksocket(4)](/ng_ksocket/4.md), [ngctl(8)](/ngctl/8.md) ## HISTORY The **ng\_socket** node type was implemented in FreeBSD 4.0. ## AUTHORS Julian Elischer ⟨*julian@FreeBSD.org*⟩ ## BUGS It is not possible to reject the connection of a hook, though any data received on that hook can certainly be ignored. The controlling process is not notified of all events that an in-kernel node would be notified of, e.g. a new hook, or hook removal. Some node-initiated messages should be defined for this purpose (to be sent up the control socket).