Networking
From socket() to the wire: how packets traverse the Linux network stack
The stack at a glance
Application: send(fd, buf, len)
│
▼
Socket layer ← struct socket, protocol-agnostic API
│
▼
TCP / UDP ← congestion control, retransmission, ports
│
▼
IP / routing ← FIB lookup, netfilter hooks, fragmentation
│
▼
Traffic control ← qdiscs, shaping, prioritization
│
▼
Device driver ← NAPI, ring buffers, offloads
│
▼
NIC ← DMA, interrupts / polling
Every packet is carried by an sk_buff — start there if you read only one page.
Pages in this section
Fundamentals
| Page | What it covers |
|---|---|
| Network Stack Overview | The layers and how they connect |
| Socket Layer | struct socket, file descriptors, protocol families |
| sk_buff | The packet data structure everything else shares |
| NAPI | Interrupt mitigation: from IRQ storm to polling |
Packet lifecycle
| Page | What it covers |
|---|---|
| Life of a Packet: RX | NIC to application, step by step |
| Life of a Packet: TX | Application to NIC, step by step |
| What Happens in connect() | Three-way handshake from the kernel's side |
TCP/IP
| Page | What it covers |
|---|---|
| TCP Internals | State machine, buffers, timers |
| TCP Congestion Control | CUBIC, BBR, pluggable algorithms |
| UDP | The thin path, and where it still surprises |
| IP Routing | FIB, rules, multipath |
| epoll | Readiness notification at scale |
Filtering & traffic control
| Page | What it covers |
|---|---|
| Netfilter | Hooks, tables, chains |
| nftables vs iptables | Why the replacement happened |
| Connection Tracking | conntrack entries, NAT, helpers |
| Traffic Control (tc/qdisc) | Queuing disciplines, shaping, fq_codel |
High performance & offload
| Page | What it covers |
|---|---|
| XDP | Processing packets before the stack |
| AF_XDP | Zero-copy userspace packet I/O |
| kTLS | TLS record processing in the kernel |
| Packet Sockets | AF_PACKET, tcpdump's view of the world |
Namespaces & virtualization
| Page | What it covers |
|---|---|
| Network Namespaces | Per-namespace stacks, veth pairs |
| Container Networking | Bridges, NAT, overlay basics |
| TUN/TAP | Userspace network devices, VPNs |
Interfaces & observability
| Page | What it covers |
|---|---|
| Netlink | The kernel's network configuration API |
| Network Debugging | ss, ethtool, drop diagnostics |
| Network Tracing | Tracepoints and BPF on the data path |
| Buffer Tuning | Socket buffers, rmem/wmem, autotuning |
| /proc/net/snmp Reference | Reading the protocol counters |