2018-06-22 20:06
浏览 87


I'm writing a simple program in Golang to capture TCP/IP packets using raw sockets:

package main

import (

func main() {
    netaddr, err := net.ResolveIPAddr("ip", "")
    if err != nil {
    conn, err := net.ListenIP("ip:tcp", netaddr)
    if err != nil {

    packet := make([]byte, 64*1024)
    numPackets := 0
    totalLen := 0
    for {
        packetLen, _, err := conn.ReadFrom(packet)
        if err != nil {

        dataOffsetWords := (packet[12] & 0xF0) >> 4
        dataOffset := 4 * dataOffsetWords
        payload := packet[dataOffset:packetLen]
        numPackets += 1
        totalLen += len(payload)
        fmt.Println("Num packets:", numPackets, ", Total len:", totalLen)

When I compare the number of packets which the program receives and the total amount of data they contain to the number of packets Wiresharks sees and the total data transmitted, I know I've lost 15-30 % of all packets and data on every run.


The only thing that comes to my mind is that the application is not fast enough to receive the packets, but that's odd. (I'm communicating on localhost and sending ~ 17 MB of data.) Goreplay however uses something similar and works.

The traffic I'm receiving is created by curl-ing onto a locally running Python server (http.server) and sending a huge file in the request body. The Python server downloads the whole body successfully.

  • 写回答
  • 好问题 提建议
  • 关注问题
  • 收藏
  • 邀请回答

1条回答 默认 最新

  • dongruo0909 2018-06-24 07:23

    My initial suspiction was right: by modifying the receiving Python server so that it does not read all incoming data at once:

     post_body =

    but rather in a loop with a 10 ms delay between iterations:

    while (total_len < content_len):
        post_body =, content_len - total_len))
        total_len += len(post_body)
        time.sleep(1 / 100.)

    I receive all data in the Golang and the number of packets processed is approximately te same (I assume there will only rarely be a match as the packets received in Golang were already processed, i.e. put back into order. Or at least I hope, because there's no much documentation.)

    Also, the packet loss changes when the delay is adjusted.

    解决 无用
    打赏 举报

相关推荐 更多相似问题