diff --git a/clatd.c b/clatd.c
index 4a34bf3..6a0a0d8 100644
--- a/clatd.c
+++ b/clatd.c
@@ -177,21 +177,6 @@
   set_capability(0);
 }
 
-/* function: open_sockets
- * opens a packet socket to receive IPv6 packets and a raw socket to send them
- *   tunnel - tun device data
- *   mark - the socket mark to use for the sending raw socket
- */
-void open_sockets(struct tun_data *tunnel) {
-  // Will eventually be bound to htons(ETH_P_IPV6) protocol,
-  // but only after appropriate bpf filter is attached.
-  tunnel->read_fd6 = socket(AF_PACKET, SOCK_DGRAM | SOCK_CLOEXEC, 0);
-  if (tunnel->read_fd6 < 0) {
-    logmsg(ANDROID_LOG_FATAL, "packet socket failed: %s", strerror(errno));
-    exit(1);
-  }
-}
-
 int ipv6_address_changed(const char *interface) {
   union anyip *interface_ip;
 
diff --git a/clatd.h b/clatd.h
index 6907829..21f3c95 100644
--- a/clatd.h
+++ b/clatd.h
@@ -41,7 +41,6 @@
 void configure_tun_ip(const struct tun_data *tunnel, const char *v4_addr, int mtu);
 void set_capability(uint64_t target_cap);
 void drop_root_and_caps();
-void open_sockets(struct tun_data *tunnel);
 int ipv6_address_changed(const char *interface);
 int configure_clat_ipv6_address(const struct tun_data *tunnel, const char *interface,
                                 const char *src_addr);
diff --git a/main.c b/main.c
index e4f7356..96fbd0d 100644
--- a/main.c
+++ b/main.c
@@ -51,6 +51,7 @@
   printf("-6 [IPv6 address]\n");
   printf("-m [socket mark]\n");
   printf("-t [tun file descriptor number]\n");
+  printf("-r [read socket descriptor number]\n");
   printf("-w [write socket descriptor number]\n");
 }
 
@@ -61,11 +62,12 @@
   struct tun_data tunnel;
   int opt;
   char *uplink_interface = NULL, *plat_prefix = NULL, *mark_str = NULL;
-  char *v4_addr = NULL, *v6_addr = NULL, *tunfd_str = NULL, *write_sock_str = NULL;
+  char *v4_addr = NULL, *v6_addr = NULL, *tunfd_str = NULL, *read_sock_str = NULL,
+       *write_sock_str = NULL;
   uint32_t mark   = MARK_UNSET;
   unsigned len;
 
-  while ((opt = getopt(argc, argv, "i:p:4:6:m:t:w:h")) != -1) {
+  while ((opt = getopt(argc, argv, "i:p:4:6:m:t:r:w:h")) != -1) {
     switch (opt) {
       case 'i':
         uplink_interface = optarg;
@@ -85,6 +87,9 @@
       case 't':
         tunfd_str = optarg;
         break;
+      case 'r':
+        read_sock_str = optarg;
+        break;
       case 'w':
         write_sock_str = optarg;
         break;
@@ -116,6 +121,15 @@
     exit(1);
   }
 
+  if (read_sock_str != NULL && !parse_int(read_sock_str, &tunnel.read_fd6)) {
+    logmsg(ANDROID_LOG_FATAL, "invalid sock_write %s", read_sock_str);
+    exit(1);
+  }
+  if (!tunnel.read_fd6) {
+    logmsg(ANDROID_LOG_FATAL, "no read_fd6 specified on commandline.");
+    exit(1);
+  }
+
   if (write_sock_str != NULL && !parse_int(write_sock_str, &tunnel.write_fd6)) {
     logmsg(ANDROID_LOG_FATAL, "invalid sock_write %s", write_sock_str);
     exit(1);
@@ -136,9 +150,6 @@
          plat_prefix ? plat_prefix : "(none)", v4_addr ? v4_addr : "(none)",
          v6_addr ? v6_addr : "(none)");
 
-  // open our raw sockets before dropping privs
-  open_sockets(&tunnel);
-
   configure_interface(uplink_interface, plat_prefix, v4_addr, v6_addr, &tunnel, mark);
 
   // run under a regular user with no capabilities