in my script kid days, ( 30 years ago ) I did something similar for linux , using raw sockets and I think with ETH_P_ALL. embedding into a an already existing regular linux process ( recompiling the source code ) the problem was high cpu usage of the process when network usage was intensive. of course it did't survive when the OS updated the program.