"Udo A. Steinberg" <reality@delusion.de> wrote:
> What happens with network data if the userspace application doesn't
> read data as fast as the NIC receives data? This is especially of
> interest in case of highspeed interfaces in promiscuous mode. Are
> packets queued to some extent by the kernel or are packets generally
> dropped in the overload case so that the application never sees them?
in packet_rcv() (from net/packet/af_packet.c) we have:
if (atomic_read(&sk->rmem_alloc) + skb->truesize >= (unsigned)sk->rcvbuf)
goto drop_n_acct;
if (skb_shared(skb)) {
struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
if (nskb == NULL)
goto drop_n_acct;
...
drop_n_acct:
po->stats.tp_lost++;
so if the receiving socket has too much data already queued, the current
skb is dropped. If the atomic allocation in skb_clone fails, the skb is
dropped. In either case, the stats for that packet socket reflect that.
You can retrieve the received and dropped statistics from the socket
with the PACKET_STATISTICS sockopt.
the story is different if you used mmap()ed packet sockets.
--
Jason Lunz Trellis Network Security
j@trellisinc.com http://www.trellisinc.com/
-
: send the line "unsubscribe linux-net" in
the body of a message to majordomo@vger.kernel.org
