skb

skb, short for socket buffer, is the core data structure used by the Linux kernel networking stack to represent packets as they move through the network stack and toward or from devices. It combines the actual packet data with metadata needed for processing, routing, filtering, and delivery to user space.

A typical skb contains a data region and a set of pointers and metadata. The data region is described by head, data, tail, and end pointers, with len indicating the length of the payload currently in the buffer. The headroom and tailroom indicate space available before and after the payload for adding headers or trailers. Header offsets are tracked via mac_header, network_header, and transport_header to identify where Ethernet, IP, and TCP/UDP headers reside. The skb also stores references to the associated network device (dev) and protocol information (for example, ETH_P_IP).

Skbs support linear and non-linear payloads. Non-linear skbs use a fragment list to describe additional page fragments, enabling efficient handling of large packets without copying. Operations such as skb_put, skb_pull, skb_reserve, and skb_trim modify the data length and pointers as the packet is built or parsed. A per-skb control area (cb) and fields like mark and priority carry metadata used by higher layers and QoS features.

Lifecycle and memory management are centralized: skbs are reference counted and freed by kfree_skb when the last reference is dropped. They can be cloned or copied (skb_clone, skb_copy) for multiple consumers. Skbs flow through both the receive path and the transmit path, being updated by protocol handlers, drivers, and networking subsystems until they are freed.

Overall, the skb data structure is a foundational element enabling efficient, flexible packet handling in the Linux networking stack.