How does a Linux socket buffer overflow?

Question

I have a Java reader application that reads from a multicast socket on a Linux 64-bit platform (2.6.18). The socket size has been set to 2 MB. When the reader cannot read fast enough the socket "overflows", i.e. packets are dropped from the buffer.

What I would like to know is how the Linux kernel drops packets out of the socket buffer. I assume that the socket buffer itself is a FIFO buffer. However, if it is full what happens? Will the next packet be discarded (and the buffer content does not change)? Or will the new packet replace an old packet in the buffer? If yes, which packet (the oldest?, the youngest?, a randomly chosen packet?)?

Thanks for any insight.

Schlemiel

Answer 1

When the buffer is full, incoming packets are discarded. Packets that are already in the buffer are not modified or replaced.

Tricolor

Thank you. Do you have a link / source that backs this statement? – Schlemiel

@AtomicJake: this is a standard practice of network design. Or: what else can OS do? IIRC when socket buffer is full TCP stack sets the window size to 0. All incoming packets in the state would be simply regarded as invalid (not fitting the window) and thus discarded. Read the RFC793, look for the "receive window." – Feudality

You are right for TCP, but I was specifically asking for a Multicast UDP read socket. As far as I know each incoming packet from the network is copied in an independent socket buffer (one buffer per reader). The socket is thus emptied by each reader at a different pace. On Linux, when a buffer is full, is a new packet simply discarded - or (as in ring buffer) overwrites the oldest entry? I would assume that both implementations are legal. – Schlemiel

Answer 2

Just an addition to the answer by JS Bangs.

This is not the only place in the network stack where packets can be dropped. Socket receive buffer is high in the hierarchy and is specific to the user socket. One other place closer to hardware (at least in Linux) is the queue between the device driver and the NET_RX softirq (see netif_rx().) These drops will contribute to RX-DRP column in netstat -i output.

Commutable

Thanks. I have established with 'sar' that indeed I lose packets on the socket buffer that is read by the application. I can see the counters when packets are dropped because of the application is too slow to read. – Schlemiel