Linux Socket Buffer (sk_buff) Deep Dive: Driver Queues, NAPI Polling, and Network Stack Traversal

Written by: TrendSpike Editorial Desk  |  Published: October 13, 2026  |  Domain: Linux Kernel Internals & Systems Engineering

The socket buffer, defined in the Linux kernel as struct sk_buff (often abbreviated as skb), represents the universal memory abstraction underpinning the entire Linux networking subsystem. Every Ethernet frame, IP packet, and TCP segment processed by the kernel is encapsulated within this structure. For systems programmers, infrastructure architects, and high-throughput network engineers, understanding the memory layout and lifecycle of sk_buff is essential for identifying latency bottlenecks, mitigating packet drop rates, and maximizing line-rate performance.

1. Anatomy and Memory Topology of struct sk_buff

The sk_buff struct itself resides in include/linux/skbuff.h. It does not contain packet payload bytes inline; instead, it consists of control metadata that points to separate, dynamically allocated memory buffers. This separation enables zero-copy operations across network layers as headers are added or stripped.

The control block maintains four fundamental pointers that dictate the boundaries of the associated packet memory:

• head: Points to the absolute start of the allocated memory buffer.
• data: Points to the current start of valid protocol data (e.g., the current layer header).
• tail: Points to the end of valid protocol data.
• end: Points to the physical end of the allocated memory buffer.

When a packet descends the egress stack, the kernel calls skb_push(), decrementing the data pointer toward head to reserve space for new encapsulation headers (such as TCP, then IPv4/IPv6, then Ethernet). Conversely, during ingress traversal, skb_pull() increments the data pointer forward, stripping parsed headers without copying memory.

2. The Ingress Path: NIC Ring Buffers to DMA Transfer

The packet ingress sequence begins on the Network Interface Card (NIC):

1. DMA Allocation: The device driver initializes an RX circular ring buffer containing physical memory addresses mapped for Direct Memory Access (DMA). These memory regions are pre-allocated by the kernel.
2. Frame Arrival: The physical PHY/MAC layer validates the frame checksum (FCS). If valid, the NIC write-engine copies the packet data directly into system RAM over the PCIe bus via DMA, bypassing CPU cycles entirely.
3. Hardware Interrupt (IRQ): Upon completing the DMA transfer, the NIC triggers an MSI-X hardware interrupt on a designated CPU core, signaling that new data has populated the RX descriptor ring.

3. NAPI (New API) and SoftIRQ Polling

To avoid "receive livelock"—a catastrophic failure state where continuous hardware interrupts consume 100% of CPU time, preventing user applications from running—the modern Linux kernel uses the NAPI polling framework:

• The top-half hardware interrupt handler executes quickly: it disables interrupts for that specific RX queue and schedules a software interrupt (NET_RX_SOFTIRQ) using napi_schedule().
• The kernel softirq daemon (ksoftirqd/x) or bottom-half context executes the driver's registered poll() method.
• The poll function loops through the RX ring descriptors up to a configurable budget (defaulting to net.core.netdev_budget = 300 packets).
• For each descriptor, the driver allocates an sk_buff metadata structure, links the DMA data buffer, validates checksum hardware offload flags (skb->ip_summed), and passes the buffer up the stack via napi_gro_receive() or netif_receive_skb().
• Once the RX queue is drained beneath the budget, interrupts are re-enabled, and polling exits.

4. Protocol Layer Demultiplexing and Traversal

Once delivered via netif_receive_skb(), the packet enters the protocol-agnostic core routing layer:

1. Traffic Control & Ingress Filters: If configured, eBPF programs attached to the tc (traffic control) ingress hook or classic qdisc routines inspect and filter the skb prior to IP parsing.

2. Network Layer (IPv4/IPv6): The packet matches registered packet types in ptype_base. For IPv4, control transfers to ip_rcv(). The IP header checksum is verified, options are parsed, and the netfilter NF_INET_PRE_ROUTING hook fires. The routing subsystem inspects the destination IP: if the packet is destined for another host, it enters ip_forward(); if addressed locally, it passes through ip_local_deliver() to the transport layer.

3. Transport Layer (TCP/UDP): In tcp_v4_rcv(), the kernel hashes the tuple (Source IP, Destination IP, Source Port, Destination Port) to locate the corresponding struct sock socket structure in the established socket hash table.

5. Socket Queues and Userspace Hand-off

Once matched to an active socket, the TCP engine performs state evaluation, window updates, and sequence validation. The sk_buff is appended to the socket's receive buffer (sk_receive_queue). The kernel awakens waiting userspace threads via epoll notifications or eventfd signals.

When the application executes a read() or recv() system call, the kernel performs the final step: copying the data payload from the sk_buff in kernel space into the application's userspace memory buffer. Once the payload is consumed, the kernel calls kfree_skb(), freeing the control structure back to the skbuff_head_cache slab allocator and recycling the underlying page buffer to the driver's memory pool.

6. Kernel Tuning Parameters for High-Throughput Workloads

For systems handling millions of packets per second, stock Linux settings often cause queue overflows. Essential sysctl optimizations include:

• net.core.netdev_max_backlog = 10000: Expands the input queue length for non-NAPI packets.
• net.core.netdev_budget = 600: Increases the number of packets processed per softirq polling cycle.
• net.ipv4.tcp_rmem = 4096 87380 16777216: Extends minimum, default, and maximum TCP receive buffer sizes.

Mastering the traversal mechanics of sk_buff ensures that low-latency systems can eliminate queue drops, optimize softirq CPU affinity, and extract full line-rate performance from modern 25G, 40G, and 100G network hardware.

Official Documentation & Kernel Sources

• • The Linux Kernel Archives: Linux Kernel Documentation — Networking Kernel Interfaces (kapi)
• • Linux Kernel Source Tree: Bootlin Elixir Cross Referencer — include/linux/skbuff.h Source Code
• • The Linux Foundation & Kernel.org: Kernel.org — NAPI (New API) Polling Infrastructure Documentation
• • Linux Manual Pages (man-pages): Man7.org — socket(7): Linux Socket Layer Interface Specification