How does a Linux socket buffer overflow?

Question

I have a Java reader application that reads from a multicast socket on a Linux 64-bit platform (2.6.18). The socket size has been set to 2 MB. When the reader cannot read fast enough the socket "overflows", i.e. packets are dropped from the buffer.

What I would like to know is how the Linux kernel drops packets out of the socket buffer. I assume that the socket buffer itself is a FIFO buffer. However, if it is full what happens? Will the next packet be discarded (and the buffer content does not change)? Or will the new packet replace an old packet in the buffer? If yes, which packet (the oldest?, the youngest?, a randomly chosen packet?)?

Thanks for any insight.

Answer 1

Just an addition to the answer by JS Bangs.

This is not the only place in the network stack where packets can be dropped. Socket receive buffer is high in the hierarchy and is specific to the user socket. One other place closer to hardware (at least in Linux) is the queue between the device driver and the NET_RX softirq (see netif_rx().) These drops will contribute to RX-DRP column in netstat -i output.

Answer 2

When the buffer is full, incoming packets are discarded. Packets that are already in the buffer are not modified or replaced.