Linux内核模块：套接字缓冲区（sk_buff-> len）非确定性行为

Question

I have a kernel module that reads packets from netfilter hook and use sk_buff to access the data.

What I am observing that when packets are coming at slow rate, sk_buff->len behaves normally but when packets arrive at higher rate (1Gbps etc) then sk_buff->len for few packets starts to increase (always a multiple of 8).

The data I am replaying has fragmented packets as well. Is it that fragmented packets gets appended in same sk_buff causing an increase in sk_buff->len ? If yes, how sk_buff is aware of the stack and at what point ?

Can someone explain that why it happens and how to get around with that. Any reference to some documentation will be helpful as well.

Answer 1

The reason for this behaviour is GRO (Generic Receive Offload). It's an optimization on the receive side just as TSO or GSO. It appends packets with same tcp and ip headers in one big skb buffer to make kernel processing easier.