Where to find the TCP data (under HTTP) inside Linux kernel?

Question

I'm trying to read the data from HTTP stream with TCP inside Linux kernel. I'm able to get most data from skb_buff here. However, if the server pushes data to the client without requests, the data won't be copied to user space so that I cannot find it any more.

Using Wireshark, I can find the additional data as a single packet normally. Therefore I think these data should go into kernel somewhere, even if they are not requested by the user space. Is it possible to find all the data when they are retrieved from Network Interface like Wireshark did? If so, where should I find them?

Thanks! Any ideas are appreciable.

EDIT: It should be different from another similar question. I even couldn't get the skb instance containing the data I need because the client didn't request it. Therefore such data won't be copied into user space. Thanks for pointing that question to me but I still need to find the correct skb instance first. I suspect I should catch the data somewhere when the data is retrieved from network interface.

Wireshark uses the pcap driver. See stackoverflow.com/questions/23189078/… — Barmar
@Barmar Thanks! And do you have any idea where the driver is inserted into the protocol stack? I guess perhaps that's the correct location I'm looking for. — zzy
@SamProtsenko Please find my further explanation at EDIT section. — zzy
@zzy Ok, I retracted my close vote. Please provide some actual code where things don't work for you. And I still don't understand where exactly your code operates -- in kernel-space or user-space? — Sam Protsenko
@SamProtsenko Thanks! I intend to work in kernel and my code simply print out data here: lxr.free-electrons.com/source/net/core/datagram.c?v=3.11#L319. In more detail, I print out the content that is copied to the user space by memcpy_toiovec(). However, when the server sends data without request, the data didn't go through here and I'm looking for where I can find such data inside kernel. — zzy