--- name: "recvmsg" section: "2" platform: "linux" package: "man-pages" version: "6.19-1" release: "Arch Linux 2026-11-01" platforms: ["linux", "freebsd", "macos"] url: "https://new.carta.tech/recv" --- # recvmsg(2) receive a message from a socket Part of [recv(2)](/recv/2.md). ## NAME recv, recvfrom, recvmsg - receive a message from a socket ## LIBRARY Standard C library (*libc*, *-lc*) ## SYNOPSIS ``` #include ``` **ssize\_t recv(**size\_t size; **int** *sockfd***, void** *buf***\[***size***\], size\_t** *size***,** **int** *flags***);** **ssize\_t recvfrom(**size\_t size; **int** *sockfd***, void** *buf***\[restrict** *size***\], size\_t** *size***,** **int** *flags***,** **struct sockaddr \*\_Nullable restrict** *src\_addr***,** **socklen\_t \*\_Nullable restrict** *addrlen***);** **ssize\_t recvmsg(int** *sockfd***, struct msghdr \****msg***, int** *flags***);** ## DESCRIPTION The **recv**(), **recvfrom**(), and **recvmsg**() calls are used to receive messages from a socket. They may be used to receive data on both connectionless and connection-oriented sockets. This page first describes common features of all three system calls, and then describes the differences between the calls. The only difference between **recv**() and [**read**(2)](/read/2.md) is the presence of *flags*. With a zero *flags* argument, **recv**() is generally equivalent to [**read**(2)](/read/2.md) (but see NOTES). Also, the following call ``` recv(sockfd, buf, size, flags); ``` is equivalent to ``` recvfrom(sockfd, buf, size, flags, NULL, NULL); ``` All three calls return the size of the message on successful completion. If a message is too long to fit in the supplied buffer, excess bytes may be discarded depending on the type of socket the message is received from. If no messages are available at the socket, the receive calls wait for a message to arrive, unless the socket is nonblocking (see [**fcntl**(2)](/fcntl/2.md)), in which case the value -1 is returned and *errno* is set to **EAGAIN** or **EWOULDBLOCK**. The receive calls normally return any data available, up to the requested amount, rather than waiting for receipt of the full amount requested. An application can use [**select**(2)](/select/2.md), [**poll**(2)](/poll/2.md), or [**epoll**(7)](/epoll/7.md) to determine when more data arrives on a socket. ### The flags argument The *flags* argument is formed by ORing one or more of the following values: - **MSG\_CMSG\_CLOEXEC** (**recvmsg**() only; since Linux 2.6.23) Set the close-on-exec flag for the file descriptor received via a UNIX domain file descriptor using the **SCM\_RIGHTS** operation (described in [**unix**(7)](/unix/7.md)). This flag is useful for the same reasons as the **O\_CLOEXEC** flag of [**open**(2)](/open/2.md). - **MSG\_DONTWAIT** (since Linux 2.2) Enables nonblocking operation; if the operation would block, the call fails with **EAGAIN** or **EWOULDBLOCK**. This provides similar behavior to setting the **O\_NONBLOCK** flag (via the [**fcntl**(2)](/fcntl/2.md) **F\_SETFL** operation), but differs in that **MSG\_DONTWAIT** is a per-call option, whereas **O\_NONBLOCK** is a setting on the open file description (see [**open**(2)](/open/2.md)), which will affect all threads in the calling process as well as other processes that hold file descriptors referring to the same open file description. - **MSG\_ERRQUEUE** (since Linux 2.2) This flag specifies that queued errors should be received from the socket error queue. The error is passed in an ancillary message with a type dependent on the protocol (for IPv4 **IP\_RECVERR**). The user should supply a buffer of sufficient size. See [**cmsg**(3)](/cmsg/3.md) and [**ip**(7)](/ip/7.md) for more information. The payload of the original packet that caused the error is passed as normal data via *msg\_iovec*. The original destination address of the datagram that caused the error is supplied via *msg\_name*. - The error is supplied in a *sock\_extended\_err* structure: - ``` #define SO_EE_ORIGIN_NONE 0 #define SO_EE_ORIGIN_LOCAL 1 #define SO_EE_ORIGIN_ICMP 2 #define SO_EE_ORIGIN_ICMP6 3 struct sock_extended_err { uint32_t ee_errno; /* Error number */ uint8_t ee_origin; /* Where the error originated */ uint8_t ee_type; /* Type */ uint8_t ee_code; /* Code */ uint8_t ee_pad; /* Padding */ uint32_t ee_info; /* Additional information */ uint32_t ee_data; /* Other data */ /* More data may follow */ }; struct sockaddr *SO_EE_OFFENDER(struct sock_extended_err *); ``` - *ee\_errno* contains the *errno* number of the queued error. *ee\_origin* is the origin code of where the error originated. The other fields are protocol-specific. The macro **SO\_EE\_OFFENDER** returns a pointer to the address of the network object where the error originated from given a pointer to the ancillary message. If this address is not known, the *sa\_family* member of the *sockaddr* contains **AF\_UNSPEC** and the other fields of the *sockaddr* are undefined. The payload of the packet that caused the error is passed as normal data. - For local errors, no address is passed (this can be checked with the *cmsg\_len* member of the *cmsghdr*). For error receives, the **MSG\_ERRQUEUE** flag is set in the *msghdr*. After an error has been passed, the pending socket error is regenerated based on the next queued error and will be passed on the next socket operation. - **MSG\_OOB** This flag requests receipt of out-of-band data that would not be received in the normal data stream. Some protocols place expedited data at the head of the normal data queue, and thus this flag cannot be used with such protocols. - **MSG\_PEEK** This flag causes the receive operation to return data from the beginning of the receive queue without removing that data from the queue. Thus, a subsequent receive call will return the same data. - **MSG\_TRUNC** (since Linux 2.2) For raw (**AF\_PACKET**), Internet datagram (since Linux 2.4.27/2.6.8), netlink (since Linux 2.6.22), and UNIX datagram as well as sequenced-packet (since Linux 3.4) sockets: return the real size of the packet or datagram, even when it was longer than the passed buffer. - For use with Internet stream sockets, see [**tcp**(7)](/tcp/7.md). - **MSG\_WAITALL** (since Linux 2.2) This flag requests that the operation block until the full request is satisfied. However, the call may still return less data than requested if a signal is caught, an error or disconnect occurs, or the next data to be received is of a different type than that returned. This flag has no effect for datagram sockets. ### recvfrom() **recvfrom**() places the received message into the buffer *buf*. The caller must specify the size of the buffer in *size*. If *src\_addr* is not NULL, and the underlying protocol provides the source address of the message, that source address is placed in the buffer pointed to by *src\_addr*. In this case, *addrlen* is a value-result argument. Before the call, it should be initialized to the size of the buffer associated with *src\_addr*. Upon return, *addrlen* is updated to contain the actual size of the source address. The returned address is truncated if the buffer provided is too small; in this case, *addrlen* will return a value greater than was supplied to the call. If the caller is not interested in the source address, *src\_addr* and *addrlen* should be specified as NULL. ### recv() The **recv**() call is normally used only on a *connected* socket (see [**connect**(2)](/connect/2.md)). It is equivalent to the call: ``` recvfrom(fd, buf, size, flags, NULL, NULL); ``` ### recvmsg() The **recvmsg**() call uses a *msghdr* structure to minimize the number of directly supplied arguments. This structure is defined as follows in *\*: ``` struct msghdr { void *msg_name; /* Optional address */ socklen_t msg_namelen; /* Size of address */ struct iovec *msg_iov; /* Scatter/gather array */ size_t msg_iovlen; /* # elements in msg_iov */ void *msg_control; /* Ancillary data, see below */ size_t msg_controllen; /* Ancillary data buffer size */ int msg_flags; /* Flags on received message */ }; ``` The *msg\_name* field points to a caller-allocated buffer that is used to return the source address if the socket is unconnected. The caller should set *msg\_namelen* to the size of this buffer before this call; upon return from a successful call, *msg\_namelen* will contain the size of the returned address. If the application does not need to know the source address, *msg\_name* can be specified as NULL. The fields *msg\_iov* and *msg\_iovlen* describe scatter-gather locations, as discussed in [**readv**(2)](/readv/2.md). The field *msg\_control*, which has size *msg\_controllen*, points to a buffer for other protocol control-related messages or miscellaneous ancillary data. When **recvmsg**() is called, *msg\_controllen* should contain the size of the available buffer in *msg\_control*; upon return from a successful call it will contain the size of the control message sequence. The messages are of the form: ``` struct cmsghdr { size_t cmsg_len; /* Data byte count, including header (type is socklen_t in POSIX) */ int cmsg_level; /* Originating protocol */ int cmsg_type; /* Protocol-specific type */ /* followed by unsigned char cmsg_data[]; */ }; ``` Ancillary data should be accessed only by the macros defined in [**cmsg**(3)](/cmsg/3.md). As an example, Linux uses this ancillary data mechanism to pass extended errors, IP options, or file descriptors over UNIX domain sockets. For further information on the use of ancillary data in various socket domains, see [**unix**(7)](/unix/7.md) and [**ip**(7)](/ip/7.md). The *msg\_flags* field in the *msghdr* is set on return of **recvmsg**(). It can contain several flags: - **MSG\_EOR** indicates end-of-record; the data returned completed a record (generally, used with sockets of type **SOCK\_SEQPACKET**). - **MSG\_TRUNC** indicates that the trailing portion of a datagram was discarded because the datagram was larger than the buffer supplied. - **MSG\_CTRUNC** indicates that some control data was discarded due to lack of space in the buffer for ancillary data. - **MSG\_OOB** is returned to indicate that expedited or out-of-band data was received. - **MSG\_ERRQUEUE** indicates that no data was received but an extended error from the socket error queue. - **MSG\_CMSG\_CLOEXEC** (since Linux 2.6.23) indicates that **MSG\_CMSG\_CLOEXEC** was specified in the *flags* argument of **recvmsg**(). ## RETURN VALUE These calls return the number of bytes received, or -1 if an error occurred. In the event of an error, *errno* is set to indicate the error. When a stream socket peer has performed an orderly shutdown, the return value will be 0 (the traditional "end-of-file" return). Datagram sockets in various domains (e.g., the UNIX and Internet domains) permit zero-size datagrams. When such a datagram is received, the return value is 0. The value 0 may also be returned if the requested number of bytes to receive from a stream socket was 0. ## ERRORS These are some standard errors generated by the socket layer. Additional errors may be generated and returned from the underlying protocol modules; see their manual pages. - **EAGAIN** or **EWOULDBLOCK** The socket is marked nonblocking and the receive operation would block, or a receive timeout had been set and the timeout expired before data was received. POSIX.1 allows either error to be returned for this case, and does not require these constants to have the same value, so a portable application should check for both possibilities. - **EBADF** The argument *sockfd* is an invalid file descriptor. - **ECONNREFUSED** A remote host refused to allow the network connection (typically because it is not running the requested service). - **EFAULT** The receive buffer pointer(s) point outside the process's address space. - **EINTR** The receive was interrupted by delivery of a signal before any data was available; see [**signal**(7)](/signal/7.md). - **EINVAL** Invalid argument passed. - **ENOMEM** Could not allocate memory for **recvmsg**(). - **ENOTCONN** The socket is associated with a connection-oriented protocol and has not been connected (see [**connect**(2)](/connect/2.md) and [**accept**(2)](/accept/2.md)). - **ENOTSOCK** The file descriptor *sockfd* does not refer to a socket. ## VERSIONS According to POSIX.1, the *msg\_controllen* field of the *msghdr* structure should be typed as *socklen\_t*, and the *msg\_iovlen* field should be typed as *int*, but glibc currently types both as *size\_t*. ## STANDARDS POSIX.1-2024. ## HISTORY POSIX.1-2001, 4.2BSD. POSIX.1 describes only the **MSG\_OOB**, **MSG\_PEEK**, and **MSG\_WAITALL** flags. ## NOTES If a zero-size datagram is pending, [**read**(2)](/read/2.md) and **recv**() with a *flags* argument of zero provide different behavior. In this circumstance, [**read**(2)](/read/2.md) has no effect (the datagram remains pending), while **recv**() consumes the pending datagram. See [**recvmmsg**(2)](/recvmmsg/2.md) for information about a Linux-specific system call that can be used to receive multiple datagrams in a single call. ## EXAMPLES An example of the use of **recvfrom**() is shown in [**getaddrinfo**(3)](/getaddrinfo/3.md). ## SEE ALSO [**fcntl**(2)](/fcntl/2.md), [**getsockopt**(2)](/getsockopt/2.md), [**read**(2)](/read/2.md), [**recvmmsg**(2)](/recvmmsg/2.md), [**select**(2)](/select/2.md), [**shutdown**(2)](/shutdown/2.md), [**socket**(2)](/socket/2.md), [**cmsg**(3)](/cmsg/3.md), [**sockatmark**(3)](/sockatmark/3.md), [**ip**(7)](/ip/7.md), [**ipv6**(7)](/ipv6/7.md), [**socket**(7)](/socket/7.md), [**tcp**(7)](/tcp/7.md), [**udp**(7)](/udp/7.md), [**unix**(7)](/unix/7.md)