Linux Networking Stack: From Packets to Applications

Client                              Server
   |                                   |
   |  -------- SYN (seq=1000) ------>  |  Client proves: "I can send"
   |                                   |
   |  <-- SYN-ACK (seq=2000,ack=1001)  |  Server proves: "I can receive AND send"
   |                                   |
   |  -------- ACK (ack=2001) ------>  |  Client proves: "I can receive"
   |                                   |
   |        Connection ESTABLISHED     |

// TCP Socket (reliable, ordered delivery)
int tcp_sock = socket(AF_INET, SOCK_STREAM, 0);

// UDP Socket (fast, no guarantees)
int udp_sock = socket(AF_INET, SOCK_DGRAM, 0);

// Raw Socket (direct IP access, requires root)
int raw_sock = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);

// Unix Domain Socket (local IPC, no network overhead)
int unix_sock = socket(AF_UNIX, SOCK_STREAM, 0);

#include <sys/socket.h>
#include <netinet/in.h>

int create_server(int port) {
    int server_fd = socket(AF_INET, SOCK_STREAM, 0);

    // Allow port reuse (avoid "Address already in use")
    int opt = 1;
    setsockopt(server_fd, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt));

    struct sockaddr_in addr = {
        .sin_family = AF_INET,
        .sin_addr.s_addr = INADDR_ANY,
        .sin_port = htons(port)
    };

    bind(server_fd, (struct sockaddr *)&addr, sizeof(addr));
    listen(server_fd, 128);  // Backlog queue

    while (1) {
        int client = accept(server_fd, NULL, NULL);
        handle_client(client);
        close(client);
    }
}

int epfd = epoll_create1(0);

struct epoll_event ev = {
    .events = EPOLLIN | EPOLLET,  // Edge-triggered
    .data.fd = socket_fd
};
epoll_ctl(epfd, EPOLL_CTL_ADD, socket_fd, &ev);

// Event loop
struct epoll_event events[MAX_EVENTS];
while (1) {
    int n = epoll_wait(epfd, events, MAX_EVENTS, -1);
    for (int i = 0; i < n; i++) {
        handle_event(events[i].data.fd);
    }
}

# Modern way
ip route show

# Output:
# default via 192.168.1.1 dev eth0
# 192.168.1.0/24 dev eth0 scope link
# 172.17.0.0/16 dev docker0 scope link

# Static route to a network
ip route add 10.0.0.0/8 via 192.168.1.1 dev eth0

# Default gateway
ip route add default via 192.168.1.1

# Source-based routing (advanced)
ip rule add from 192.168.2.0/24 table custom
ip route add default via 10.0.0.1 table custom

# Temporarily
echo 1 > /proc/sys/net/ipv4/ip_forward

# Permanently
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p

                          ┌─────────────────┐
                          │  Local Process  │
                          └────────┬────────┘
                                   │
    Network ──►  PREROUTING ──►  INPUT
        │                          ▲
        │                          │ (local destination)
        │                          │
        └──────►  FORWARD ─────────┴──►  POSTROUTING ──►  Network
                    │                         ▲
                    └─────────────────────────┘
                      (forwarded packets)

                          OUTPUT ────────────►  POSTROUTING ──►  Network
                            ▲
                            │
                    ┌───────┴───────┐
                    │ Local Process │
                    └───────────────┘

# Allow established connections (most efficient rule first!)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow SSH from specific network
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

# Allow HTTP/HTTPS
iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT

# Drop everything else (default deny)
iptables -P INPUT DROP

# Increase buffer sizes for high-bandwidth links
sysctl -w net.core.rmem_max=134217728
sysctl -w net.core.wmem_max=134217728
sysctl -w net.ipv4.tcp_rmem="4096 87380 134217728"
sysctl -w net.ipv4.tcp_wmem="4096 65536 134217728"

# Use BBR congestion control (Google's algorithm)
sysctl -w net.ipv4.tcp_congestion_control=bbr
sysctl -w net.core.default_qdisc=fq

# Increase ring buffer
ethtool -G eth0 rx 4096 tx 4096

# Enable offloading
ethtool -K eth0 gso on gro on tso on

# Receive Packet Steering (multi-core)
echo f > /sys/class/net/eth0/queues/rx-0/rps_cpus

# Create namespace
ip netns add mycontainer

# Create virtual ethernet pair
ip link add veth0 type veth peer name veth1

# Move one end into namespace
ip link set veth1 netns mycontainer

# Configure host side
ip addr add 10.0.0.1/24 dev veth0
ip link set veth0 up

# Configure container side
ip netns exec mycontainer ip addr add 10.0.0.2/24 dev veth1
ip netns exec mycontainer ip link set veth1 up
ip netns exec mycontainer ip link set lo up

# Test connectivity
ping 10.0.0.2

# Active connections
ss -tunap

# Packet capture
tcpdump -i eth0 'tcp port 80'

# Route tracing
traceroute google.com
mtr google.com  # Better interactive version

# Performance testing
iperf3 -s        # Server
iperf3 -c host   # Client