How Does Linux Process Incoming and Outgoing Network Packets?

Linux servers receive network packets and must perform a series of steps—initializing the network subsystem, registering protocol stacks, initializing NIC drivers, and starting the NIC—before they can actually begin receiving data.

Network Protocol Stack

Before discussing Linux packet transmission, it is useful to understand the Linux network protocol stack.

The OSI model defines seven layers: application, presentation, session, transport, network, data link, and physical. In practice, the simpler TCP/IP model is used, consisting of four layers.

The four TCP/IP layers are:

Application layer – provides services such as FTP, Telnet, DNS, SMTP.

Transport layer – offers end‑to‑end communication, ensuring ordered delivery and data integrity via TCP and UDP.

Network layer – handles host‑to‑host communication, routing, and IP addressing (IP, IGMP, ICMP).

Network interface layer – corresponds to the OSI physical and data‑link layers, monitoring data exchange between host and network; protocols such as ARP operate here.

Receiving Network Packets

When a packet arrives at the NIC, it is placed in the NIC’s receive queue (FIFO) and transferred via DMA into a ring buffer in memory, which holds sk_buff descriptors.

Upon arrival, the ring buffer provides a pointer to an sk_buff descriptor; DMA writes the packet data into that address. After the upper‑layer protocol stack processes the data, the ring buffer entry is updated with a new sk_buff .

The NIC then raises a hardware interrupt. The CPU’s interrupt handler locates the registered interrupt service routine.

Hardware interrupt handling includes:

1. Masking the NIC interrupt

This prevents the CPU from being overwhelmed by frequent interrupts; masking tells the NIC that the kernel has already allocated memory for the packet, so further packets can be written directly without additional interrupts.

2. Triggering a soft interrupt to unmask the NIC

The kernel’s ksoftirqd thread receives the soft interrupt and invokes the appropriate handler, which polls the ring buffer, extracts a frame into an sk_buff , and passes it up the protocol stack.

The protocol stack processes the packet as follows:

1. Network interface layer

It validates the frame, discards it if malformed, determines the upper‑layer protocol (IPv4/IPv6), strips the frame header/trailer, and forwards the payload to the network layer.

2. Network layer

The IP header is examined; if the packet is destined for the local host, the payload is handed to the transport layer after removing the IP header.

3. Transport layer

The TCP or UDP header is parsed, the four‑tuple (source IP, source port, destination IP, destination port) is used to locate the corresponding socket, and the data is copied into the socket’s receive buffer.

4. Application layer

The application reads data from the socket, copying it from the kernel’s socket buffer into user‑space.

At this point the reception of the network packet is complete.

Sending Network Packets

Sending follows the reverse of reception. An application invokes the socket send interface, causing a system call that transitions from user mode to kernel mode.

The socket layer allocates a kernel‑mode sk_buff, copies the user data into it, and places it in the socket’s transmit queue.

The protocol stack then adds the necessary protocol headers as the packet moves down the layers.

Processing steps for an outbound packet:

1. Transport layer

A TCP header is added, and a copy of the sk_buff is created because the original will be released after transmission; this copy ensures reliable delivery until an ACK is received.

2. Network layer

The layer selects a route, inserts the IP header, applies netfilter rules, and fragments the packet if it exceeds the MTU, then passes it to the network interface layer.

3. Network interface layer

It resolves the next‑hop MAC address, adds the frame header and trailer, and enqueues the frame for transmission, subsequently generating a soft interrupt to notify the NIC driver.

4. NIC device

The NIC reads the frame from its FIFO queue via DMA and transmits it on the wire. After transmission, the NIC raises a hardware interrupt to free the sk_buff and clean the ring buffer. When an ACK for the TCP segment arrives, the transport layer releases the original sk_buff .

The sending process is now complete.