Networking

Purpose

net/ is the kernel's network stack. It implements every layer from the device-independent socket layer down through transports (TCP, UDP, SCTP, MPTCP, QUIC), IP and IPv6, ARP/neighbor discovery, multicast, routing, the netfilter hook framework, traffic control, eBPF networking (XDP, tc, sockmap), bridging, the wireless control plane (mac80211 core), bluetooth, and many auxiliary protocols.

It is one of the largest and most actively-developed parts of the kernel.

Directory layout

net/
├── core/              # Common code: dev, skbuff, sockets, filter, page_pool, gro, fib, neigh, …
├── ipv4/              # IPv4: TCP, UDP, ARP, IP, routing, netfilter
├── ipv6/              # IPv6: TCP6, UDP6, ND, IPv6 routing
├── ethernet/          # Ethernet helpers
├── netfilter/         # Hook framework, conntrack, NAT, nftables, ipset
├── sched/             # Traffic control (tc): qdiscs, classes, classifiers, actions
├── bpf/               # BPF-net glue (xdp, sockmap)
├── sched/             # tc, qdisc/cls/act
├── tls/               # Kernel TLS
├── psample/, devlink/, dcb/, ethtool/, handshake/  # Control-plane plumbing
├── mptcp/             # Multipath TCP
├── mctp/              # Management Component Transport Protocol
├── smc/               # SMC (RDMA-style sockets)
├── tipc/, sctp/, dccp/, rds/, sunrpc/, vmw_vsock/, x25/, atm/, can/, appletalk/, decnet/, irda/(removed)
├── 802/, 8021q/, bridge/, dsa/, batman-adv/        # Layer-2
├── wireless/, mac80211/                            # Wi-Fi
├── bluetooth/                                       # Bluetooth
├── nfc/                                             # Near-field communication
├── 9p/, ceph/                                       # Network-FS protocols
├── unix/                                            # AF_UNIX
├── packet/, key/, l2tp/, hsr/                      # Specialized
├── ieee802154/, 6lowpan/                           # 802.15.4
├── netlink/                                         # AF_NETLINK / genetlink
├── openvswitch/                                     # OvS datapath
├── xdp/                                             # AF_XDP sockets
├── xfrm/                                            # IPsec
├── ife/, ipvs/(under netfilter)
└── …

Key abstractions

Symbol	File	Purpose
struct net_device	include/linux/netdevice.h	A network interface (eth0, wlan0, lo).
struct sk_buff	include/linux/skbuff.h, net/core/skbuff.c	A network packet at any layer.
struct sock	include/net/sock.h	Generic kernel-side socket.
struct net	include/net/net_namespace.h	A network namespace — independent stack.
struct fib_table, struct fib_rules	net/ipv4/fib_*	Forwarding information base.
struct neighbour	net/core/neighbour.c	ARP / NDP table entry.
struct bpf_prog (XDP, tc)	include/linux/bpf.h	BPF programs attached to network hooks.
struct nf_hook_ops	include/linux/netfilter.h	Netfilter hook registration.
struct Qdisc, struct tcf_proto	net/sched/	Traffic control.

How it works

graph TD
    NIC[NIC driver] -->|napi_poll, gro_receive| RX[Soft IRQ NET_RX]
    RX -->|XDP attach| XDP[XDP program]
    XDP -->|pass| RX2[netif_receive_skb]
    XDP -->|tx/drop/redirect| FAST[Fast path out]
    RX2 --> DELIV["protocol_handlers (ip_rcv, arp_rcv, …)"]
    DELIV --> IP[ip_rcv → ip_local_deliver / ip_forward]
    IP --> NF[Netfilter NF_INET_*]
    NF --> TR["transport (tcp_v4_rcv, udp_rcv, …)"]
    TR --> SOCK[Socket queue]
    SOCK --> APP[User-space recv]
    APP -->|send| SO[sendmsg]
    SO --> TR2[transport sendmsg]
    TR2 --> IP2[ip_queue_xmit]
    IP2 --> NF2[Netfilter NF_INET_*]
    NF2 --> QDISC[qdisc enqueue/dequeue]
    QDISC --> NIC

Core layer

net/core/ is the device-independent code: dev.c (registration, RX/TX dispatch), skbuff.c (packet allocator), sock.c (socket lifecycle), filter.c (eBPF/cBPF filter machinery), page_pool.c (per-NIC page allocator for zero-copy), gro.c (Generic Receive Offload), fib_rules.c (rule-based routing), neighbour.c (neighbor cache), flow_dissector.c (5-tuple extraction), and many more.

IPv4 / IPv6

net/ipv4/ and net/ipv6/ implement the network layer. tcp.c, tcp_input.c, tcp_output.c, tcp_cong.c (congestion control plug-ins), udp.c, icmp.c, plus IP itself in ip_*.c. inet_connection_sock.c and inet_hashtables.c are the glue.

Congestion control modules live in net/ipv4/tcp_*.c: cubic, bbr, vegas, dctcp, etc. Selectable via sysctl net.ipv4.tcp_congestion_control.

Netfilter and nftables

net/netfilter/ is the hook framework. Hooks are inserted at NF_INET_PRE_ROUTING, _LOCAL_IN, _FORWARD, _LOCAL_OUT, _POST_ROUTING. Implementations:

• iptables / ip6tables (legacy) — xt_*.c, plus ipv4/netfilter/, ipv6/netfilter/.
• nftables — modern unified API, code in nf_tables_*.c.
• conntrack — nf_conntrack_*.c. Tracks flows; basis for stateful matching and NAT.
• NAT — nf_nat_*.c.
• ipset — ipset/.
• IPVS — ipvs/. L4 load balancer.

Traffic control

net/sched/ is tc(8)'s in-kernel side. qdiscs (queueing disciplines) like pfifo, sfq, htb, fq, fq_codel, cake. classifiers (cls_u32, cls_bpf, cls_flower). actions (act_mirred, act_skbedit). Hardware-offload glue allows pushing classifiers to NICs.

eBPF networking

• XDP — xdp_*.c and core/dev.c. Runs on RX before skb allocation.
• tc-bpf — cls_bpf attaches programs to qdiscs.
• sockmap / sockhash — sock_map.c. Redirect socket data plane.
• AF_XDP — net/xdp/. Zero-copy raw socket family.
• bpf_lsm, kfunc integration — across many points.

Wireless

• net/wireless/ — cfg80211, the control plane shared by all Wi-Fi drivers.
• net/mac80211/ — soft-MAC stack used by most Wi-Fi drivers; performs frame management, encryption negotiation, scanning.
• Drivers under drivers/net/wireless/.

Other notable areas

• TLS (net/tls/) — kernel-side TLS record layer. Used by gnutls, OpenSSL via KTLS.
• MPTCP (net/mptcp/) — Multipath TCP.
• xfrm (net/xfrm/) — IPsec.
• DSA (net/dsa/) — Distributed Switch Architecture for Ethernet switches.
• bridge (net/bridge/) — Linux bridge with VLAN, MDB, IGMP snooping, STP.
• OpenvSwitch (net/openvswitch/) — OvS datapath.

Integration points

• drivers/net/: NIC drivers register net_devices and call napi_*/netif_receive_skb/netif_rx_*.
• fs/: AF_UNIX uses VFS. AF_NETLINK is used by VFS components for ABI (e.g. inotify is via netlink? no, separate; but rtnetlink and genetlink are heavily used by user-space tools).
• kernel/bpf/: BPF programs attached to XDP, tc, cgroup-skb, sock-ops.
• security/: LSM hooks in socket creation, bind, send/recv.
• mm/: page pool, skb alloc.
• io_uring/: async networking ops.

Key source files

File	Purpose
net/core/dev.c	Net-device registration, RX/TX dispatch. The single largest file in net/.
net/core/skbuff.c	sk_buff allocator.
net/core/sock.c	Generic struct sock operations.
net/core/filter.c	BPF/cBPF helpers, classic-to-eBPF translator.
net/socket.c	The socket() / bind() / connect() syscall interface.
net/ipv4/tcp.c, tcp_input.c, tcp_output.c	TCP.
net/ipv4/route.c, fib_*.c	Routing.
net/netfilter/nf_tables_api.c	nftables.
net/sched/sch_*.c	Qdiscs.
net/xdp/xsk.c	AF_XDP sockets.
net/tls/tls_main.c	Kernel TLS.

Entry points for modification

• New protocol: register proto_ops and a proto. Look at SCTP / MPTCP recent commits.
• New congestion control: implement struct tcp_congestion_ops. Many examples under net/ipv4/tcp_*.c.
• New qdisc: implement struct Qdisc_ops. See net/sched/sch_fq_codel.c.
• New netfilter hook: write a module that registers nf_hook_ops.
• New BPF helper / kfunc for networking: define under net/core/filter.c or similar.
• New TC classifier/action: see net/sched/cls_*.c / net/sched/act_*.c.

Related pages

• Drivers — NIC drivers (drivers/net/).
• Kernel core — eBPF.
• Security — LSM hooks on sockets.
• io_uring — async networking ops.