How Linux Receives and Sends Network Packets: A Step‑by‑Step Guide

Linux Network Stack Overview

Before a Linux server can receive network packets, it must initialize the network subsystem, register protocol stacks, load NIC drivers, and bring up the network interface. The TCP/IP model, which Linux implements, consists of four layers: Application, Transport, Network, and Network Interface.

Receiving a Network Packet

When a packet arrives at the NIC, it is placed in a FIFO receive queue and transferred via DMA into a kernel ring buffer that holds sk_buff descriptors.

The NIC writes the packet into the ring buffer; the kernel later updates the descriptor to point to a newly allocated sk_buff .

The NIC then raises a hardware interrupt. The interrupt handler masks further NIC interrupts, schedules a soft‑interrupt, and the ksoftirqd thread processes the packet by pulling the sk_buff from the ring buffer and passing it up the protocol stack.

The protocol stack processes the packet in the following order:

Network Interface Layer : Validates the frame, discards invalid packets, determines the protocol (IPv4/IPv6), strips the frame header/footer, and forwards the payload to the Network layer.

Network Layer : Removes the IP header, decides whether to forward or deliver locally, extracts the transport protocol (TCP/UDP), and passes the payload to the Transport layer.

Transport Layer : Strips the TCP/UDP header, uses the 4‑tuple (source IP, source port, dest IP, dest port) to locate the corresponding socket, and copies the data into the socket’s receive buffer.

Application Layer : The application reads data from the socket buffer via standard socket APIs.

At this point the packet reception is complete.

Sending a Network Packet

Sending starts with an application calling send() on a socket, which traps into the kernel’s socket layer. The kernel allocates a new sk_buff, copies user data into it, and places it in the socket’s send queue.

The protocol stack then processes the packet from the top down:

Transport Layer : Adds a TCP (or UDP) header and creates a copy of the sk_buff to allow retransmission until an ACK is received.

Network Layer : Performs routing lookup, inserts an IP header, applies netfilter rules, and fragments the packet if it exceeds the MTU.

Network Interface Layer : Resolves the next‑hop MAC address (ARP), adds Ethernet frame headers/trailers, queues the frame for transmission, and triggers a soft‑interrupt to notify the NIC driver.

NIC Device : The driver reads frames from the transmit queue via DMA, writes them to the NIC’s FIFO, and sends them on the wire. After transmission, the NIC generates a hardware interrupt to free the sk_buff and ring‑buffer resources; the sk_buff is finally released when the corresponding TCP ACK arrives.

Thus the packet transmission process is finished.