``` #include <sys/socket.h> #include <netinet/in.h> #include <stdio.h> int main(void) { /* AF_INET三层原始IP套接字，创建时即校验CAP_NET_RAW/root，socket rax=41 */ int fd = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP); if (fd < 0) { perror("socket raw"); /* 无CAP_NET_RAW时EPERM(1) */ return 1; } int on = 1; setsockopt(fd, IPPROTO_IP, IP_HDRINCL, &on, sizeof(on)); /* 自填IP头 */ close(fd); return 0; } ``` 链路：`socket()` → glibc 置 `rax=41`，`rdi=AF_INET/AF_PACKET`、`rsi=SOCK_