How Linux Handles Incoming and Outgoing Network Packets: A Deep Dive

Network Protocol Stack

Linux implements the TCP/IP model, which consists of four layers: application, transport, network, and network‑interface. Each layer has specific responsibilities, such as providing services (FTP, DNS) at the application layer, ensuring reliable delivery at the transport layer (TCP/UDP), routing and addressing at the network layer (IP, ICMP, IGMP), and handling physical transmission and ARP at the network‑interface layer.

Receiving Network Packets

When a packet arrives at the NIC, it is placed in a FIFO receive queue and DMA copies it into a ring buffer containing sk_buff descriptors. An interrupt notifies the CPU, which invokes the registered interrupt handler.

The handler first masks further NIC interrupts, then triggers a soft‑interrupt (ksoftirqd) to process the packet without blocking the CPU.

The kernel then processes the packet through the stack:

Network‑interface layer : validates the frame, determines the protocol (IPv4/IPv6), strips the frame header/footer, and passes the payload upward.

Network layer : extracts the IP header, decides whether to forward or deliver locally, removes the IP header, and hands the packet to the transport layer.

Transport layer : reads the TCP or UDP header, uses the 4‑tuple (source IP, source port, dest IP, dest port) to locate the corresponding socket, and copies data into the socket’s receive buffer.

Application layer : the application reads data from the socket buffer via the socket API.

After these steps the packet reception is complete.

Sending Network Packets

Sending follows the reverse order. An application calls the socket send API, causing a system call that transitions to kernel space. The kernel allocates an sk_buff, copies user data into it, and places it in the socket’s send queue.

The networking stack then adds protocol headers layer by layer:

Transport layer : adds a TCP header and creates a copy of sk_buff to allow retransmission.

Network layer : selects a route, adds an IP header, applies netfilter rules, and fragments if necessary.

Network‑interface layer : resolves the next‑hop MAC address via ARP, builds the Ethernet frame, and enqueues it for transmission.

NIC device : the driver reads the frame from the transmit queue, uses DMA to write it to the NIC’s FIFO, and the NIC sends it on the wire. After transmission, a hardware interrupt frees the sk_buff and ring‑buffer resources; the ACK from the remote side later releases the original sk_buff in the transport layer.

Thus the packet transmission process concludes.