How Does Linux Receive and Send Network Packets? A Step‑by‑Step Walkthrough

Network Protocol Stack

Before discussing how Linux receives and sends network packets, it is useful to understand the Linux network protocol stack. The OSI model defines seven layers, but Linux implements the simpler TCP/IP model, which has four layers: Application, Transport, Network, and Network Interface.

Application layer provides services such as FTP, Telnet, DNS, SMTP, etc.

Transport layer offers end‑to‑end communication (TCP, UDP) and ensures ordered, reliable delivery.

Network layer handles host‑to‑host communication, routing, and includes protocols like IP, IGMP, and ICMP.

Network Interface layer corresponds to the OSI physical and data‑link layers, dealing with MAC addressing (ARP) and interfacing with the actual network hardware.

Receiving Network Packets

When a packet arrives at the NIC, it is placed in the NIC’s receive queue (FIFO) and transferred via DMA into a kernel ring buffer that holds sk_buff descriptors.

Upon arrival, the kernel fetches the sk_buff descriptor from the ring buffer, writes the data via DMA, and after upper‑layer processing updates the descriptor for the next packet.

The NIC then raises a hardware interrupt. The CPU’s interrupt handler disables further NIC interrupts, schedules a soft‑irq, and the ksoftirqd thread processes the packet by converting the descriptor into an sk_buff and passing it up the stack.

The processing flow through the TCP/IP stack is:

Network Interface layer : validates the frame, strips Ethernet headers, determines the next‑level protocol (IPv4/IPv6), and forwards the payload.

Network layer : removes the IP header, decides whether to forward or deliver locally, and passes the payload to the transport layer.

Transport layer : extracts TCP/UDP headers, uses the 4‑tuple (src IP, src port, dst IP, dst port) to locate the corresponding socket, and copies data into the socket’s receive buffer.

Application layer : the application reads data from the socket buffer via the socket API.

At this point the receive process is complete.

Sending Network Packets

Sending follows the reverse path. An application calls the socket send API, causing a system call that creates a kernel sk_buff and copies user data into it, placing it in the socket’s send queue.

The protocol stack then processes the packet layer by layer:

Transport layer : adds a TCP or UDP header and creates a copy of the sk_buff to allow retransmission if needed.

Network layer : selects a route, fills the IP header, applies netfilter rules, and fragments the packet if it exceeds the MTU.

Network Interface layer : resolves the next‑hop MAC address (ARP), adds Ethernet frame headers/trailers, and enqueues the frame for transmission, triggering a soft‑irq.

NIC device : the driver reads the frame from the transmit queue, uses DMA to write it to the NIC’s FIFO, and the NIC sends the frame onto the physical network. After transmission the NIC raises a hardware interrupt to free the sk_buff and ring‑buffer resources.

When the remote side acknowledges the packet, the transport layer releases the original sk_buff, completing the send process.