Finding out the number of dropped packets in raw sockets

Question

I am developing a program that sniffs network packets using a raw socket (AF_PACKET, SOCK_RAW) and processes them in some way.

I am not sure whether my program runs fast enough and succeeds to capture all packets on the socket. I am worried that the recieve buffer for this socket occainally gets full (due to traffic bursts) and some packets are dropped.

How do I know if packets were dropped due to lack of space in the socket's receive buffer?

I have tried running ss -f link -nlp.

This outputs the number of bytes that are currently stored in the revice buffer for that socket, but I can not tell if any packets were dropped.

I am using Ubuntu 14.04.2 LTS (GNU/Linux 3.13.0-52-generic x86_64).

Answer 1

Packets dropped could be seen from netstat,ethtool outputs. For UDP packet drops check output of 'netstat -us'. Packets are also dropped at NIC layer itself, which could be seen via 'ethtool -S <device_name>'

Example outputs:

$ netstat -us
IcmpMsg:
    InType3: 44
    InType8: 5
    InType13: 1
    InType17: 3
    InType37: 1
    OutType0: 5
    OutType3: 599
    OutType8: 4
    OutType14: 1
Udp:
    86942 packets received
    209 packets to unknown port received.
    **0 packet receive errors** <== This indicates packets dropped due to socket buffer full
    213901 packets sent
UdpLite:
IpExt:
    InOctets: 38683476091
    OutOctets: 959938111

Try using larger buffer space(SO_RCVBUF) and increase system wide maximum via sysctl control net.core.rmem_max

At NIC layer, as well you could try increasing ring buffers to handle bursty traffic ( check settings via ethtool -g )

Answer 2

You can retrieve the total number of received packets and the number of dropped packets in your program using PACKET_STATISTICS socket option as described in the packet(7) manpage.

#include <linux/if_packet.h>
#include <sys/socket.h>
#include <sys/types.h>

...

struct tpacket_stats lStats = {};
socklen_t lStatsLength = sizeof( lStats );
if ( getsockopt( mRawSocket, SOL_PACKET, PACKET_STATISTICS, &lStats, &lStatsLength ) == 0 )
{
    printf( "Total Packets: %u\nDropped Packets: %u\n", lStats.tp_packets, lStats.tp_drops );
}
else
{
    perror( "Failed to get network receive statistics" );
}