1

"Missing" in the sense of couldn't capture or nowhere to be found.

I am writing a program that sends parallel ICMP ping requests then reads and processes the replies. But I stumbled across a missing reply problem as the parallel requests increase in number. 5 writer threads seems okay, 10 writer threads starts to make some replies disappear. But I wanted to handle thousands (modestly).

Currently I have parallel writers (sendto()) which waits 3 seconds between every request. I have single thread for reading, it waits until recvfrom() gets data.

Here is my program's log:

log.txt image

At first I thought I couldn't process replies fast enough, so I seperated the receive and process mechanisms in a queue. But turns out the reply is not coming in the first place (If I am interpreting the wireshark log properly).

Here is the WireShark log:

wireshark log image

Turns out wireshark is smart enough to correlate the ICMP requests and replies. It also confirms 3 replies are missing.

What I am doing:

  • Creating socket such as,

    sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);

  • Not setting anything with setsockopt(), which maybe the problem and the solution. I don't know what to do here.

  • I am using a single socket for all the parallel read/write operations, because I am told the kernel manages the concurrency.

  • sendto(sockfd, &pkt, sizeof(pkt), 0, (sockaddr*) &addr, sizeof(addr))

  • recvfrom(recv_sockfd, &recv_pkt, sizeof(recv_pkt), 0, (sockaddr*)&r_addr, &addr_len)

What I tried:

  • Make the receiving thread faster by separating some logic, turns out it being slow wasn't the issue.
  • Use different sockets for write (still single for parallel) and read.

What I know:

  • The replies may not be arriving because the request is never sent. All I know is sendto() returns greater than zero. And wireshark says the request exists.

Is there some detail about raw sockets that I am missing ?

Rockybilly
  • 2,938
  • 1
  • 13
  • 38
  • What if the destination machine just doesn't wanna reply all the time? Not sure, if this can be possible. – kiner_shah Aug 05 '22 at 11:12
  • @kiner_shah I was just testing that, I was lazily using the same server for every request. Now tried different servers and 10 servers seems okey. It's really hard to find 100 servers to test. I thought using different ID's in requests would act as different ICMP clients, but of course they are coming from the same IP nonetheless. – Rockybilly Aug 05 '22 at 11:15
  • Offtopic: Isn't easier to copy paste logs as text? You can even quickly find and replace private data. – Marek R Aug 05 '22 at 11:19
  • @MarekR I usually do paste as text, in this example it was really repetitive and it didn't contain any meaningful data to copy from (except if you wanted to compare every output, which I did already). I tried to make it more readable with a picture, but you're right that, Windows Text Editor output is almost the same as StackOverflow text format :D So it was unnecessary indeed. – Rockybilly Aug 05 '22 at 11:30

0 Answers0