30 comments

[ 2.6 ms ] story [ 70.4 ms ] thread
I'm surprised to realize I'm familiar with most of the stack just from decades of Linux usage and no formal study of the stack.
This place needs more of this kind of documentation.

I failed to use IP tables for years. I bought books. I copied recipes from blog posts. Nothing made sense, everything I did was brittle. Until I finally found a schematic showing the flowchart of a packet through the kernel, which gives the exact order that each rule chain is applied, and where some of the sysctl values are enforced. All of a sudden, I could write rules that did exactly what I wanted, or intelligently choose between rules that have equivalent behaviors in isolation but which could have different performance implications.

After studying the schematic, every would just work on the first try. A good schematic makes a world of difference!

It is also worth mentioning TRACE target that will dump to logs which exact rule the packet hit, it's invaluable big firewalls.
> I failed to use IP tables for years.

Me too, then I discovered FreeBSD and pf tables. I _feel_ like an expert network engineer now. It took time and effort of course, but the learning process "clicked" for me all along the way and I was able to build on my understandings. Give it a try!

https://docs.freebsd.org/en/books/handbook/firewalls/

There was a recent book published on the tool, The Book of PF, 4th Edition

That's pretty cool!

If someone could program a visualization tool that would generate such diagrams automatically, that would be even cooler (but likely a mission impossible).

Automatic generation would be really tough because of all the levels of abstraction traversed in this diagram in particular... But tools like Mermaid / PlantUML can get you in the ballpark, and PGF/TikZ could be a reasonable target if you want to attack that mission by generating text instead of images.
I'm not sure if this takes into account para-virtualized networks on VMs, ie. VMware vm's with "virtual" hardware access

It's been a few years for me tho, so perhaps it's covered with the VM section.

Lovely diagram, thanks for sharing it!

These usually attach in the bridge or NAT flow.
Is it possible we see the diagram as an svg? I am seeing it only as embedded in the pdf, and really difficult to read .
Click on "Download" below the embedded PDF viewer and you'll get the PDF.
Fools admire complexity.
There’s complication, and there’s complexity. Fools admire complication, engineers design solutions to complex problems. This is a diagram explaining the latter.
Where/how would you simplify it without losing features?
For containers you will also have own TCP/IP stack similarly to what is shown for VM on the diagram, this is done when a container uses slirp4netns to provide networking. An alternative is to use kernel TCP/IP stack, this is done when pasta is used for networking, diagram on this page shows the details:https://passt.top/passt/about/.
Any recommendations for a map of Linux user-space network management options?
qdisc is too small in this diagram and to easy to miss.
Anyone figure out what the colour scheme means?
*simplified.

Doesn't even go into iptables/nftables

Thanks Hrvoje Horvat for such a detailed diagram! It'll help me learn the Network stack much, much easier.

His book "Operativni sustavi i računalne mreže - Linux u primjeni" [0] (Operating systems and computer networks - Linux in use) may well make learning Croatian worth it! Congrats on publishing, and thanks for such an invaluable contribution!

[0]: https://zenodo.org/records/17371946

Incredible work! I really wish the author's book had an English translation.
Is there some sort of equivalent to this book but in English, which explains and diagrams the Linux network stack? Doesn't need to be all in one, I feel like having a more high level overview and then subsystem diagrams with explanations would work as well.
Good thing we have Hacker News