Linux Kernel TCP Connection Visualizer

Incoming Packet Lifecycle (NIC to Application)

1. Packet arrives at NIC, copied via DMA to kernel ring buffer. NIC raises interrupt.
2. CPU handles interrupt, driver's ISR (top-half) runs briefly, disables NIC interrupts, schedules deferred work (NAPI).
3. NAPI poll function (bottom-half/softirq) runs, processes packets from ring buffer in batches.
4. Driver allocates sk_buff for packet, maps data, returns DMA buffer to NIC.
5. Driver passes sk_buff up using e.g., netif_receive_skb().
6. Network stack determines L3 protocol (e.g., IP) from L2 header, strips L2 header.
7. IP layer (ip_rcv) validates IP header, checks routing (finds local destination), determines L4 protocol (e.g., TCP), strips IP header.
8. TCP layer (tcp_v4_rcv) finds matching socket via 4-tuple lookup.
9. Processes TCP header (seq/ack numbers, flags). For DATA on ESTABLISHED: queues sk_buff data in socket receive queue (sk->sk_receive_queue). Schedules TCP ACK.
10. Kernel wakes up application process if it was sleeping in e.g., recv() waiting for data.
11. Application resumes in kernel mode (system call). Kernel copies data from sk_buff(s) in receive queue to app's user-space buffer.
12. Kernel frees processed sk_buff(s). System call returns number of bytes copied.
13. Application execution returns to user space with data in its buffer.