recv(2)

✨ NAME ✨

recv, recvfrom, recvmsg — bestie, this is how you receive a message from a socket 💌

(Also filed under section 2, System Calls Manual, if you're keeping track 👑)

---

📚 LIBRARY 📚

Standard C library (libc, -lc) — yeah she lives in libc, no cap 🫶

---

🌀 SYNOPSIS 🌀

#include <sys/socket.h>

ssize_t recv(size_t size;
                 int sockfd, void buf[size], size_t size,
                 int flags);
ssize_t recvfrom(size_t size;
                 int sockfd, void buf[restrict size], size_t size,
                 int flags,
                 struct sockaddr *_Nullable restrict src_addr,
                 socklen_t *_Nullable restrict addrlen);
ssize_t recvmsg(int sockfd, struct msghdr *msg, int flags);

---

💖 DESCRIPTION 💖

Okay so. The recv(), recvfrom(), and recvmsg() calls are the trio that receives messages from a socket. They work on both connectionless and connection-oriented sockets — equal opportunity icons 🌈. This page does it in two acts: first the stuff all three share, then the tea on how they differ. Stay with me bestie, it's giving structure ✨

The only difference between recv() and read(2) is the presence of flags. With a zero flags argument, recv() is generally equivalent to read(2) — but see NOTES, because there's a lil asterisk situation there 🙈. Also, this call right here:

recv(sockfd, buf, size, flags);

is equivalent to:

recvfrom(sockfd, buf, size, flags, NULL, NULL);

All three calls return the size of the message on successful completion 💅. And if a message is too long to fit in the buffer you supplied? Excess bytes may be discarded, depending on what type of socket the message is coming from. So size your buffers, bestie, don't play yourself 😭

If there are no messages available at the socket, the receive calls wait for a message to arrive — unless your socket is nonblocking (see fcntl(2)), in which case the value -1 is returned and errno gets set to EAGAIN or EWOULDBLOCK. And here's the thing to internalize: the receive calls normally return any data available, up to the requested amount — they don't sit around waiting for the full amount you asked for. It's giving "what you get is what's there" 🤷‍♀️

An application can use select(2), poll(2), or epoll(7) to figure out when more data arrives on a socket. Very demure, very mindful, very event-driven 🌸

---

🚩 The flags argument 🚩

The flags argument gets formed by ORing one or more of these values together. Mix and match, it's a vibe:

• MSG_CMSG_CLOEXEC (recvmsg() only; since Linux 2.6.23) — Sets the close-on-exec flag for the file descriptor received via a UNIX domain file descriptor using the SCM_RIGHTS operation (described in unix(7)). This flag is useful for the exact same reasons the O_CLOEXEC flag of open(2) is useful. Same energy, different call 💅
• MSG_DONTWAIT (since Linux 2.2) — Turns on nonblocking operation. If the operation would block, the call fails with EAGAIN or EWOULDBLOCK. This is a similar behavior to setting the O_NONBLOCK flag (via the fcntl(2) F_SETFL operation), but here's the plot twist 👀: MSG_DONTWAIT is a per-call option, whereas O_NONBLOCK is a setting on the open file description (see open(2)) — which means it affects all threads in the calling process as well as other processes that hold file descriptors referring to that same open file description. So per-call = just this one, description-wide = everyone's problem 😅
• MSG_ERRQUEUE (since Linux 2.2) — This flag says: give me the queued errors from the socket error queue. The error comes back in an ancillary message with a type dependent on the protocol (for IPv4 that's IP_RECVERR). You, the user, should supply a buffer of sufficient size. See cmsg(3) and ip(7) for more. The payload of the original packet that caused the error is passed as normal data via msg_iovec. The original destination address of the datagram that caused the error is supplied via msg_name.

The error itself is supplied in a sock_extended_err structure:

#define SO_EE_ORIGIN_NONE    0
#define SO_EE_ORIGIN_LOCAL   1
#define SO_EE_ORIGIN_ICMP    2
#define SO_EE_ORIGIN_ICMP6   3

struct sock_extended_err
{
    uint32_t ee_errno;   /* Error number */
    uint8_t  ee_origin;  /* Where the error originated */
    uint8_t  ee_type;    /* Type */
    uint8_t  ee_code;    /* Code */
    uint8_t  ee_pad;     /* Padding */
    uint32_t ee_info;    /* Additional information */
    uint32_t ee_data;    /* Other data */
    /* More data may follow */
};

struct sockaddr *SO_EE_OFFENDER(struct sock_extended_err *);

ee_errno contains the errno number of the queued error. ee_origin is the origin code of where the error originated. The other fields are protocol-specific. The macro SO_EE_OFFENDER returns a pointer to the address of the network object where the error originated from, given a pointer to the ancillary message. If that address isn't known, the sa_family member of the sockaddr contains AF_UNSPEC and the other fields of the sockaddr are undefined. The payload of the packet that caused the error gets passed as normal data.

For local errors, no address is passed — you can check that with the cmsg_len member of the cmsghdr. For error receives, the MSG_ERRQUEUE flag is set in the msghdr. And after an error has been passed, the pending socket error is regenerated based on the next queued error, and it'll be passed on the next socket operation. Regenerating, like a queen 👑

• MSG_OOB — Requests receipt of out-of-band data that wouldn't be received in the normal data stream. Some protocols place expedited data at the head of the normal data queue, and so this flag cannot be used with such protocols. Read the room, bestie 🚫
• MSG_PEEK — Makes the receive operation return data from the beginning of the receive queue without removing that data from the queue. So a subsequent receive call will return the same data again. It's a lil sneak peek, not a take 🙈
• MSG_TRUNC (since Linux 2.2) — For raw (AF_PACKET), Internet datagram (since Linux 2.4.27/2.6.8), netlink (since Linux 2.6.22), and UNIX datagram as well as sequenced-packet (since Linux 3.4) sockets: return the real size of the packet or datagram, even when it was longer than the buffer you passed. For use with Internet stream sockets, see tcp(7).
• MSG_WAITALL (since Linux 2.2) — Requests that the operation block until the full request is satisfied. However — and this is important — the call may still return less data than requested if a signal is caught, an error or disconnect occurs, or the next data to be received is of a different type than that returned. This flag has no effect for datagram sockets. So "wait all" is more like "wait most, if the universe permits" 😭

---

📬 recvfrom() 📬

recvfrom() places the received message into the buffer buf. The caller must specify the size of the buffer in size.

If src_addr is not NULL, and the underlying protocol provides the source address of the message, that source address is placed into the buffer pointed to by src_addr. In this case, addrlen is a value-result argument — meaning it's giving both ways, bestie, it goes in with a value and comes out with a value ✨

• Before the call, it should be initialized to the size of the buffer associated with src_addr.
• Upon return, addrlen is updated to contain the actual size of the source address.

The returned address gets truncated if the buffer provided is too small — and in that case, addrlen will return a value greater than was supplied to the call. So if you see a bigger number coming back than you sent in, that's your signal that you got clipped 📏

If the caller is not interested in the source address, src_addr and addrlen should be specified as NULL. Not your business, don't ask 💅

---

🎀 recv() 🎀

The recv() call is normally used only on a connected socket (see connect(2)). It is equivalent to the call:

recvfrom(fd, buf, size, flags, NULL, NULL);

---

🦋 recvmsg() 🦋

The recvmsg() call uses a msghdr structure to minimize the number of directly supplied arguments. Fewer args, cleaner vibe, iconic honestly 👑

This structure is defined as follows in <sys/socket.h>:

struct msghdr {
    void         *msg_name;       /* Optional address */
    socklen_t     msg_namelen;    /* Size of address */
    struct iovec *msg_iov;        /* Scatter/gather array */
    size_t        msg_iovlen;     /* # elements in msg_iov */
    void         *msg_control;    /* Ancillary data, see below */
    size_t        msg_controllen; /* Ancillary data buffer size */
    int           msg_flags;      /* Flags on received message */
};

The msg_name field points to a caller-allocated buffer that's used to return the source address if the socket is unconnected. The caller should set msg_namelen to the size of this buffer before the call; upon return from a successful call, msg_namelen will contain the size of the returned address. If the application doesn't need to know the source address, msg_name can be specified as NULL.

The fields msg_iov and msg_iovlen describe scatter-gather locations, as discussed in readv(2), so go read that one too, bestie 🌈

The field msg_control, which has size msg_controllen, points to a buffer for other protocol control-related messages or miscellaneous ancillary data. When recvmsg() is called, msg_controllen should contain the size of the available buffer in msg_control; upon return from a successful call, it'll contain the size of the control message sequence. In-and-out, value-result again, she's versatile 💅

The messages are of this form:

struct cmsghdr {
    size_t cmsg_len;    /* Data byte count, including header
                           (type is socklen_t in POSIX) */
    int    cmsg_level;  /* Originating protocol */
    int    cmsg_type;   /* Protocol-specific type */
/* followed by
    unsigned char cmsg_data[]; */
};

Ancillary data should be accessed only by the macros defined in cmsg(3). Do not freestyle this one. Poking at it manually is how you get hurt 💀

As an example, Linux uses this ancillary data mechanism to pass extended errors, IP options, or file descriptors over UNIX domain sockets. For further information on the use of ancillary data in various socket domains, see unix(7) and ip(7). Ancillary data really said "I contain multitudes" 🫶

The msg_flags field in the msghdr is set on return of recvmsg(). It can contain several flags:

• MSG_EOR — indicates end-of-record; the data returned completed a record (generally, used with sockets of type SOCK_SEQPACKET). That's a wrap on this record, periodt ✨
• MSG_TRUNC — indicates that the trailing portion of a datagram was discarded because the datagram was larger than the buffer supplied. Ripped, unfortunately 😭
• MSG_CTRUNC — indicates that some control data was discarded due to lack of space in the buffer for ancillary data. Same tragedy, different buffer 🥲
• MSG_OOB — is returned to indicate that expedited or out-of-band data was received.
• MSG_ERRQUEUE — indicates that no data was received but an extended error from the socket error queue. Surprise! It was an error the whole time 🎁
• MSG_CMSG_CLOEXEC (since Linux 2.6.23) — indicates that MSG_CMSG_CLOEXEC was specified in the flags argument of recvmsg(). Yeah, it just tells you what you already told it. Very "as per my last email" of it 💅

---

💖 RETURN VALUE 💖

okay so these calls hand u back the number of bytes received, or -1 if something went wrong. And if there's an error? errno gets set to tell u what's up. no cap.

When a stream socket peer has done an orderly shutdown, the return value is literally 0 — the classic "end-of-file" return, bestie. 🥹

Datagram sockets in various domains (e.g., the UNIX and Internet domains) are out here permitting zero-size datagrams ✨. When one of those shows up, the return value is 0.

And 0 can also come back if the requested number of bytes to receive from a stream socket was 0. it's giving "nothing to see here" 💅.

😭 ERRORS 😭

These are some standard errors generated by the socket layer. Additional errors may be generated and returned from the underlying protocol modules; see their manual pages. (iykyk, always check the protocol module's page too 🫶)

• EAGAIN or EWOULDBLOCK — the socket is marked nonblocking and the receive operation would block, or a receive timeout had been set and the timeout expired before data was received. POSIX.1 allows either error to be returned for this case, and does not require these constants to have the same value, so a portable application should check for both possibilities. both. check both. periodt.
• EBADF — the argument sockfd is an invalid file descriptor. 💀
• ECONNREFUSED — a remote host refused to allow the network connection (typically because it is not running the requested service). ouch.
• EFAULT — the receive buffer pointer(s) point outside the process's address space. 🫠
• EINTR — the receive was interrupted by delivery of a signal before any data was available; see signal(7).
• EINVAL — invalid argument passed.
• ENOMEM — could not allocate memory for recvmsg().
• ENOTCONN — the socket is associated with a connection-oriented protocol and has not been connected (see connect(2) and accept(2)).
• ENOTSOCK — the file descriptor sockfd does not refer to a socket.

✨ VERSIONS ✨

According to POSIX.1, the msg_controllen field of the msghdr structure should be typed as socklen_t, and the msg_iovlen field should be typed as int, but glibc currently types both as size_t. glibc said "we do a little trolling" 😭.

👑 STANDARDS 👑

POSIX.1-2024. slay.

🦋 HISTORY 🦋

POSIX.1-2001, 4.2BSD. vintage but iconic.

POSIX.1 describes only the MSG_OOB, MSG_PEEK, and MSG_WAITALL flags. the way that it only lists those three... 🙈

🎀 NOTES 🎀

If a zero-size datagram is pending, read(2) and recv() with a flags argument of zero provide different behavior. In this circumstance, read(2) has no effect (the datagram remains pending), while recv() consumes the pending datagram. different behavior, same vibe check? no bestie, they really do different things.

See recvmmsg(2) for information about a Linux-specific system call that can be used to receive multiple datagrams in a single call. batch recv? obsessed.

🌈 EXAMPLES 🌈

An example of the use of recvfrom() is shown in getaddrinfo(3). go look, it's cute.

💜 SEE ALSO 💜

fcntl(2), getsockopt(2), read(2), recvmmsg(2), select(2), shutdown(2), socket(2), cmsg(3), sockatmark(3), ip(7), ipv6(7), socket(7), tcp(7), udp(7), unix(7)

---

and that's a wrap, bestie 🎀 — this page comes from Linux man-pages 6.20, dated 2025-10-29, and it's literally the recv(2) manual. stay iconic, check ur return values, and never forget to close ur sockets 💅✨