Networking Stack
Socket API, sk_buff lifecycle, TCP/IP stack, NAPI polling, netfilter hooks, XDP, and eBPF packet processing — the net subsystem dissected.
Subsystem Overview
The Linux networking stack is a layered architecture spanning from the socket API in user space down to NIC drivers. At its core is the sk_buff (socket buffer) — a metadata-rich descriptor that carries a packet through every layer without copying data. Each layer adds or strips headers by adjusting sk_buff pointers rather than moving bytes.
Packet reception follows the NAPI (New API) model: the NIC raises a single interrupt to schedule a softirq poll loop, which drains the ring buffer in batches. This amortises interrupt overhead at high packet rates. On the transmit path, the qdisc (queuing discipline) layer implements traffic shaping and scheduling before handing frames to the driver.
Linux 7.2 landed BBRv3 TCP congestion control as the new default for inter-datacenter flows, extended XDP with multi-buffer support for jumbo frames, and added a new netlink-based API for managing hardware offload rules in the TC subsystem.
// key sk_buff fields — include/linux/skbuff.h
Diagrams
// interactive · click nodes to explore
sk_buff Lifecycle
Packet journey from NIC DMA through L2/L3/L4 to the socket receive buffer, with kernel function annotations.
NAPI Receive Loop
Interrupt-mitigation flow: NIC IRQ → napi_schedule() → NET_RX_SOFTIRQ → napi_poll() → budget check.
Netfilter Hook Points
Five NF_INET hook attachment points in the IPv4 stack — PREROUTING, INPUT, FORWARD, OUTPUT, POSTROUTING.
Key Concepts
sk_buff (socket buffer)
The universal packet descriptor. Contains pointers to the data area (head, data, tail, end), protocol headers, device metadata, and a chain of extension structs. Layers manipulate sk_buff->data and sk_buff->len rather than copying bytes, keeping packet processing O(1) per layer.
NAPI (New API)
The interrupt-mitigation framework for high-speed NICs. On first packet arrival the NIC fires an interrupt; the handler disables further interrupts and schedules a softirq poll. The poll loop calls napi_poll() to drain the ring buffer in batches of up to netdev_budget packets before re-enabling interrupts.
Netfilter & nftables
The in-kernel packet filtering framework. Defines hook points at PREROUTING, INPUT, FORWARD, OUTPUT, and POSTROUTING in the IPv4/IPv6 stack. nftables is the modern rule engine (replacing iptables) using a bytecode VM evaluated per packet at each hook.
XDP (eXpress Data Path)
A programmable fast path that runs eBPF programs at the earliest point in the receive path — before sk_buff allocation. XDP programs can DROP, PASS, TX (hairpin), or REDIRECT packets with near-wire-speed performance. Requires driver support or falls back to generic XDP.
TCP Congestion Control
Pluggable via the tcp_congestion_ops interface. Built-in algorithms include CUBIC (default LAN), BBR (bandwidth-delay product), and RENO. BBRv3, landed in 7.2, uses a model-based approach with pacing and probing phases to saturate bandwidth without filling buffers.
qdisc (Queuing Discipline)
The traffic control layer between the IP stack and the NIC driver. Implements packet scheduling (pfifo_fast, fq, fq_codel, HTB) and shaping. The TC subsystem allows attaching eBPF classifiers and actions at qdisc hooks for programmable traffic steering.
Source References
// net/ · include/linux/ · annotated entry points
Linux 7.2 Changes
// recent net/ commits