Linux Network Stack Kernel Subsystem

The Packet Path Through the Linux Kernel

This page visualizes the Linux network stack as a layered funnel from userspace to the wire. A packet leaves an application through a socket syscall, is buffered by the socket layer, paced by the transport layer (TCP with a congestion window and RTT estimate, or connectionless UDP), routed by the IP layer, inspected by Netfilter and connection tracking, handed to the NIC driver over DMA rings and NAPI/softirq polling, and finally serialized onto the wire by the network interface.

Stack Layers

• Userspace — socket(), connect(), sendmsg/recvmsg, epoll and poll.
• Socket API — struct sock, accept backlog, send/receive buffers and backpressure.
• TCP / UDP — congestion window (cwnd), RTT/RTO estimation, retransmission, SACK.
• IP — FIB routing lookup, fragmentation, TTL, ICMP, IPv4 and IPv6.
• Netfilter — iptables/nftables hooks, NAT and conntrack state (NEW/ESTABLISHED).
• Driver — DMA ring buffers, TX queue/qdisc, NAPI and softirq, GRO/GSO offload.
• NIC — PHY/MAC, link speed and duplex, RX/TX error counters, virtio-net in cloud.

TCP BBR Path Model

The page includes a live TCP BBR model. BBR (Bottleneck Bandwidth and Round-trip propagation time) continuously measures the maximum delivery rate it has seen (BtlBw) and the minimum round-trip time (RTprop). Their product is the bandwidth-delay product (BDP) — the amount of data in flight that keeps the path full without queueing. BBR paces sending at BtlBw and caps inflight near BDP, avoiding the bufferbloat that loss-based CUBIC creates by filling router buffers until packets drop. It is control theory rather than machine learning, but it is a model of the network path learned online from the traffic itself.