Receive TCP payloads from socket immediately (packet-by-packet) in C

Question

How can I receive data (byte stream) from an open network socket in C on a packet-by-packet basis? I want to read data from the socket IMMEDIATELY as it arrives (as soon as the packet arrives on the machine).

It seems when I perform a read() (or recv()) call on the socket, I am getting the entire TCP message of 10,000+ bytes. Rather, I would like to receive the first TCP segment payload, process it, then continue to the next, etc.

Note - I don't want raw packets. Just the TCP segment data payload.

Also note - In essence I want to minimize delay by processing data immediately as it arrives, as opposed to waiting for the entire TCP message to accumulate in the TCP layer.

Any ideas would be much appreciated, thanks!

Have you taken into account that TCP packets can be received out of order? Also, this sounds like something where UDP would be a better option — Earlz
have you checked the actual delay you want to eliminate? what does tcpdump show? — Karoly Horvath
@earlz: 100% disagree on UDP comment. With UDP you give up huge functionality (and typically re-implement half of it). — John M

gnometorule gnometorule · Accepted Answer · 2011-09-14T22:30:40

Maybe I misunderstand your question (eg, I can't quite make sense of 'don't want raw packets just the TCP payload'), but a simple raw socket (IPPROTO_TCP) connected and then sniffed on with recv() will do the job. You indicate a maximum buffer size as an argument in recv(), but when a TCP load comes, it will be reported back - no waiting for the buffer to fill up. Here is some code excerpt that prints out TCP packets:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#include // your header to print out bytes and error messages here

int main(void) {
    int i, recv_length, sockfd;
    u_char buffer[9000];

    if ((sockfd = socket(PF_INET, SOCK_RAW, IPPROTO_TCP)) == -1)
        // your error message here

    for(i=0; i < 3; i++) {
        recv_length = recv(sockfd, buffer, 8000, 0);
        printf("Got a %d byte packet\n", recv_length);
        // your routine to print out bytes here
    }
}

If this isn't what you were concerned about, kindly clarify.

Edit: From what I hear and read, using library pcap (libcap) is superior to using raw sockets (more reliable; very powerful - written by the guys who wrote tcpdump). However, I'm still learning pcap myself and so far am struggling to get it to work properly with wireless devices. But maybe look into that too if you need this on an on-going basis.

Receive TCP payloads from socket immediately (packet-by-packet) in C

4 Answers