TCP call flow in Linux Kernel

3
votes

I am trying to get the TCP call flow inside the Linux Kernel with a version 3.8 for different user space APIs such as connect, bind, listen and accept. Can anyone provide me with a flowchart for flow calls? I was able to find for data flow using send and recv APIs.

Another question, when a client connects to a server, the server creates a new socket to that client for that specific connection returned by the accept API. My question does the Linux Kernel maintain any relation between the listening socket and the socket derived from it in some hash bind table or not?

2
linuxsocketstcplinux-kernel
this is a great question, I'm interested in the answer as well – Devarsh Desai
Rs your second question, there's no reason why it should. Once accepted. The sockets are independent. – user207421
If you very much interested in call flow, I suggest to use some tool like systemtap, ftrace for understanding the code flow. For ftrace linuxseekernel.blogspot.com/2014/05/… – Jeyaram

2 Answers

2
votes

1st question:

http://www.danzig.jct.ac.il/tcp-ip-lab/ibm-tutorial/3376c210.html

All the lectures at Haifux are classic:

http://www.haifux.org/lectures/172/netLec.pdf

http://www.haifux.org/lectures/217/netLec5.pdf

And this is from the original author/maintainer in linux networking himself:

http://vger.kernel.org/~davem/skb.html

http://vger.kernel.org/~davem/tcp_output.html

http://vger.kernel.org/~davem/tcp_skbcb.html

2nd question: Yes, all existing connections are maintained in a critical table: tcp_hashinfo. Its' memory address can be read from /proc/kallsyms. "critical" because reading from it requires locking, so don't try walking the table even though you have the address. Use globally exported symbols like "inet_lookup_listener" or "inet_lookup_established" to walk the table instead.

More info here:

How to identify a specific socket between User Space and Kernel Space?

0
votes

Flowcharts? Flow diagrams? Not a chance. We would love to have them, but they do not exist but you can review the code; patches happily reviewed.

A socket returns a file descriptor; the process file descriptor table maintains the association between the socket and the other kernel data structures. The file descriptor makes this a simple array indexing operation, no hashing needed.