3

I am developing a program that sniffs network packets using a raw socket (AF_PACKET, SOCK_RAW) and processes them in some way.

I am not sure whether my program runs fast enough and succeeds to capture all packets on the socket. I am worried that the recieve buffer for this socket occainally gets full (due to traffic bursts) and some packets are dropped.

How do I know if packets were dropped due to lack of space in the socket's receive buffer?

I have tried running ss -f link -nlp.

This outputs the number of bytes that are currently stored in the revice buffer for that socket, but I can not tell if any packets were dropped.

I am using Ubuntu 14.04.2 LTS (GNU/Linux 3.13.0-52-generic x86_64).

  • tcpdump can report the number of dropped packets so maybe you can look at it to see what it is doing – Skaperen Jun 9 '15 at 10:30
2

Packets dropped could be seen from netstat,ethtool outputs. For UDP packet drops check output of 'netstat -us'. Packets are also dropped at NIC layer itself, which could be seen via 'ethtool -S <device_name>'

Example outputs:

$ netstat -us
IcmpMsg:
    InType3: 44
    InType8: 5
    InType13: 1
    InType17: 3
    InType37: 1
    OutType0: 5
    OutType3: 599
    OutType8: 4
    OutType14: 1
Udp:
    86942 packets received
    209 packets to unknown port received.
    **0 packet receive errors** <== This indicates packets dropped due to socket buffer full
    213901 packets sent
UdpLite:
IpExt:
    InOctets: 38683476091
    OutOctets: 959938111

Try using larger buffer space(SO_RCVBUF) and increase system wide maximum via sysctl control net.core.rmem_max

At NIC layer, as well you could try increasing ring buffers to handle bursty traffic ( check settings via ethtool -g )

0

You can retrieve the total number of received packets and the number of dropped packets in your program using PACKET_STATISTICS socket option as described in the packet(7) manpage.

#include <linux/if_packet.h>
#include <sys/socket.h>
#include <sys/types.h>

...

struct tpacket_stats lStats = {};
socklen_t lStatsLength = sizeof( lStats );
if ( getsockopt( mRawSocket, SOL_PACKET, PACKET_STATISTICS, &lStats, &lStatsLength ) == 0 )
{
    printf( "Total Packets: %u\nDropped Packets: %u\n", lStats.tp_packets, lStats.tp_drops );
}
else
{
    perror( "Failed to get network receive statistics" );
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.