← Dictionary
Development

What is Network Stack?

The Network Stack is the collection of hardware drivers, kernel, and user-space protocol layers that enable an operating system or hardware to transmit, route, and receive data packets over a network.

1. Layered architecture: OSI 7 Layer vs TCP/IP 4 Layer

In network communication, the OSI 7-Layer Model defined by ISO is used in theory, and in practice the TCP/IP Model, which forms the backbone of the Internet:

  • Application Layer (L7): HTTP/HTTPS, DNS, SSH, gRPC. This is the level where data is presented to or generated by the user.
  • Transport Layer (L4): TCP (reliable and ordered transmission), UDP (speed-oriented streaming), and QUIC (basis of HTTP/3). The protocol data unit is called a Segment.
  • Internet / Network Layer (L3): IPv4, IPv6, ICMP, BGP. It enables the routing of packets globally. The protocol data unit is called a Packet.
  • Network Interface / Data Link Layer (L2/L1): Ethernet (802.3), Wi-Fi (802.11), fiber optic and copper lines. The protocol data unit is defined as a Frame.
Analogy: It is similar to an international shipping operation: You write the letter (Application), put the letter in an envelope and attach a return receipt (TCP), place the envelope in a box with an international address (IP), the box is loaded into a container (Ethernet Frame), and it crosses the ocean by cargo ship (Physical line).

2. Packet encapsulation and decapsulation flow

When a client sends a request to a web server, as the data moves down the stack, each layer adds its own header:

[Kullanıcı Verisi: "GET / HTTP/1.1"]
                   ↓ (Taşıma Katmanı - TCP başlığı eklenir: Portlar, Sıra No)
[TCP Header | Payload]  --> TCP Segment (MSS ~1460 bayt)
                   ↓ (Ağ Katmanı - IP başlığı eklenir: Kaynak/Hedef IP)
[IP Header | TCP Header | Payload]  --> IP Paketi (MTU: 1500 bayt)
                   ↓ (Veri Bağı Katmanı - Ethernet başlığı ve FCS kuyruğu eklenir)
[Ethernet Header | IP Header | TCP Header | Payload | FCS Tail]  --> Ethernet Frame

When it reaches the target server, the process reverses (decapsulation); the headers are stripped layer by layer and the data is delivered to the socket.

3. Network Stack lifecycle in the Linux kernel

  1. Hardware and Ring Buffer: The NIC captures the packet and copies it to the RX Ring Buffer in RAM via DMA.
  2. Hard IRQ & SoftIRQ (NAPI): The NIC triggers a hardware interrupt; to prevent CPU lockup, the kernel processes packets in batches (polling) via ksoftirqd in NAPI mode.
  3. sk_buff (Socket Buffer): The kernel allocates an sk_buff data structure that carries pointers for each packet.
  4. Filtering and Routing: nftables rules are scanned, and if the packet belongs to a local socket, it is handed over to the TCP state machine.
  5. System Call: The packet is placed into the socket's receive buffer (recv-Q); the application reads the data via epoll_wait().

4. Kernel Bypass and next-generation networking: eBPF / XDP and DPDK

  • eBPF and XDP (eXpress Data Path): Packets are filtered at the network card driver layer before an sk_buff is even allocated; giants like Cloudflare drop DDoS attacks here without placing any load on the kernel.
  • DPDK (Data Plane Development Kit): It completely bypasses the kernel; the application in the user space accesses the network card memory directly with zero-copy.
  • QUIC / HTTP/3: The transport layer has transitioned from core TCP to a UDP-based encrypted protocol that operates in user space and overcomes head-of-line blocking.

Questions and answers

What does 'network stack' mean, and what is its Turkish equivalent?

In Turkish, it is called "ağ yığını" or "protokol yığını". It is a hierarchy of hardware and software rules layered on top of each other that enables a computer to communicate over a network.

Where is the fundamental difference between TCP and UDP located within the network stack?

It is located at the Transport Layer (L4). TCP guarantees that packets arrive complete and in order via an acknowledgment mechanism (ACK); UDP, on the other hand, fires packets at maximum speed without waiting for acknowledgment.

What is MTU (Maximum Transmission Unit)?

It is the largest packet size that a network interface can carry in a single frame without fragmentation. For standard Ethernet, the MTU value is 1500 bytes.

Why is Kernel Bypass architecture used?

It is used to eliminate the interrupt and memory copying overheads of the Linux kernel at extremely high data volumes such as 100 Gbps, and to process packets directly at the hardware level with zero latency using DPDK and eBPF/XDP.

Related terms

VPNRuntimeMemory ManagementPacket FragmentationAPI

Related tools

OpenFlux

This explanation was written in plain language for TreScout with AI and machine-translated from the Turkish original · the Turkish version prevails. If something looks wrong or missing, write to hello@trescout.com. Read in Turkish →