Uncovering the Path of a Network Packet: From Hardware to User-Space Programs

TJ. Podobnik, @dorkamotorka
6 min readDec 5, 2022

Have you ever wondered how an application receives a network packet? It’s a fascinating topic that delves into the intricacies of the Linux networking stack. But where do you start? Understanding packets and their formats are just the tip of the iceberg.

In this post, we’ll take a deep dive into the journey of a network packet, from the moment it’s received at the hardware level to its arrival in a user-space program. I’ll share my own experiences, research, and insights as a non-kernel developer, and explain how this knowledge can be used in projects like analyzing container primitives and BPF programs. Join me on a journey to uncover the inner workings of network packets.

Linux Networking Stack

This picture should already sum it up for you, but if you’re fairly new to the topic you might as well wanna know what’s the purpose of each component and what are the states through which the packet goes before it reaches your application.

Stack Breakdown

Virtually, we can disassemble the Linux networking stack in 3 stages:

  • Device Driver
  • Kernel Space
  • User Space

In the upcoming sections, we will look at each one in detail, although nowadays the distinction…

--

--