Journey of a packet

1
Journey of a packet

• Mahendra M
• Mahendra_M_at_infosys.com
• http//symonds.net/mahmk

2
The Network Stack
Journey of a packet
Application
Transport ( TCP )
Network ( IP )
Physical
3
The whole story
Journey of a packet

• Journey of a packet from its ingress into the
  computer to its delivery to user land

4
Physical ( Ethernet )
Journey of a packet

• N/w card listens for a particular MAC address and
  is always listening for packets on its interface
• Receives packets to its MAC address or the link
  layer broadcast address FFFFFFFFFFFF
• Upon reception of a packet ........

5
Physical ( Ethernet ).........(contd)
Journey of a packet

• NIC generates an Interrupt Request ( IRQ )
• The card driver is the Interrupt Service Routine
  ( ISR ) - disables interrupts
• Allocates a new sk_buff structure
• Fetches packet data from card buffer to freshly
  allocated sk_buff ( using DMA )
• Invokes netif_rx()
• When netif_rx() returns, the Interrupts are
  re-enabled and the ISR is terminated

6
netif_rx() function
Journey of a packet

• Prepares kernel for the next reception step
• Receives a packet from a Network Device Driver (
  NDD ) and queues it for upper-layer processing
• Single gathering point for all N/w card drivers
• Provides input to upper protocol's processing
• Returns a value indicating the current congestion
  level

7
netif_rx() issues
Journey of a packet

• Since it is an ISR, it has to be quick.
• Cannot perform lengthy checks
• Selects packet queue ( a queue for each CPU - SMP
  machines )
• Checks status of queue for congestion
• NET_RX_SUCCESS
• NET_RX_CN_ ( LOW / MOD / HIGH )
• NET_RX_DROP - critical congestion ( throttling
  policy to go back to non-congested state - avoids
  kernel overload and DOS attacks )

8
Next step ( Next layer )
Journey of a packet

• Execution time not critical
• NET_RX softirq is used
• net_rx_action() is called
• Dequeues the first packet from the queue
• Runs the packet through 2 lists of packet
  handlers
• ptype_all - Generic packet types
• ptype_base - Specific packet types
• Loops on the packet queues till a threshold
• NET_RX calls in sequence each registered protocol
  handler function

9
IP Packet handlers
Journey of a packet

• ip_rcv() is called for protocol type ETH_P_IP
• Checks IP packet ( checksum, header, packet
  length )
• ip_rcv_finish() is called if the packet is OK
• Checks whether packet is to be routed or
  delivered locally. skb -gt dst -gt input
  ip_local_deliver()
• ip_local_deliver() deals with re-assembly and
  calls ip_local_deliver_finish()
• Trims packet for delivery to upper layers
• Checks whether the packet belongs to a raw socket

10
Transport Layer handling
Journey of a packet

• The protocol field inside IP header is checked
• For each Transport Layer protocol a handler is
  registered at kernel startup time
• tcp_v4_rcv(), udp_rcv(), icmp_rcv(), igmp_rcv()
• The functions return value is checked to see if
  ICMP Destination Unreachable message.

11
What is happening
Journey of a packet
Receiving Process
wake_up_interruptible()
Socket Level
data_ready()
TCP Processing
UDP
ICMP
udp_rcv()
tcp_rcv()
icmp_rcv()
Other Layer 3 Proc
AF_INET ( IP )
AF_PACKET
ip_rcv()
packet_rcv()
_rcv()
Deferred pkt rcptn
net_rx_action()
Low Lever Pkt Rx
netif_rx()
Ethernet Driver
12
TCP handling
Journey of a packet

• TCP processing is intricate - Finite State
  Machine
• tcp_v4_rcv() performs TCP header checks
• Look for a socket - __tcp_v4_lookup()
• Pass skbuff to tcp_v4_do_rcv()
• Perform different receive actions inside this
  function
• Calls sk_filter() - the Linux Socket Filter

13
TCP handling (contd....)
Journey of a packet

• If the packet matches filter rules, processing
  goes on as usual
• If the TCP connection is already established, the
  packet is passed on to tcp_rcv_established()
• Deals with TCP ACKs, header processing
• Calls data_ready()

14
UDP Processing
Journey of a packet

• Much simpler than TCP
• udp_rcv() is called
• Performs some integrity checks before selecting
  the receiving socket - udp_v4_lookup()
• Calls udp_queue_rcv_skb()
• Calls sock_queue_rcv_skb() which queues the UDP
  packet on the socket buffer. If buffer is full,
  packet is discarded.
• Performs sk_filter()
• If no socket is found, packet is discarded.

15
Finally.........
Journey of a packet

• The process waiting on the receiving socket is
  awakened by the wake_up_interruptible() call
• The entire data is passed on to the application,
  which then does its own processing on the data.

16
Based on
Journey of a packet

• Gianluca Insolvible's articles on Linux Socket
  Filters and Linux Packet Handling

17
Resources
Journey of a packet

• http//netfilter.gnumonks.org
• http//www-nrg.ee.lbl.gov/nrg.html
• The Linux Source Code
• ( Just a few million lines !!!!! )
• Thankyou