Sockets and the Network Stack
Between the application's write and the wire sit kernel queues and protocol processing. We follow a send: the syscall copies bytes into the socket's send buffer, TCP segments them, the device driver queues them, and the NIC transmits — then trace the receive path in reverse, through the receive queue to recvfrom.
Topics covered:
- The socket: the file descriptor and its send and receive buffers
- Syscall boundaries: where the application copy ends and the kernel begins
- Segmentation and checksum offload to the NIC
- The receive path: interrupt, softirq, and the socket's receive queue
- Blocking vs. non-blocking: what EAGAIN and poll and epoll observe
- Why loopback traffic never touches a NIC at all
Related articles
TCP Nagle and Delayed ACK: Why Small Writes Stall for 40ms
The Nagle algorithm and delayed ACK interaction that adds a 40ms stall to small writes, how to see it in tcpdump, and when TCP_NODELAY actually helps.
HTTP Keep-Alive and Connection Reuse: What the Machine Actually Does
Why HTTP/1.1 needs Connection: keep-alive, what the server timeout does, and how curl and ss reveal whether your connections are being reused or rebuilt.
DNS Resolution End to End: From resolv.conf to Recursive Lookup
What really happens when you resolve a hostname — resolvers, cache TTLs, CNAME chains, EDNS, TCP fallback on truncation, and how DoH changes the path.
More in Networking
HTTP/3 and QUIC Explained
The transport protocol that replaces TCP — multiplexing without head-of-line blocking, connection migration, and 0-RTT.
WatchThe Full Lifecycle of an HTTP Request
Watch a single request travel from a browser through DNS, TCP, TLS, HTTP, a load balancer, a server, and a database — with live packet-level tracing.
WatchIP Routing Explained
How a packet travels from host to host — longest-prefix matching in forwarding tables, next-hop resolution, and what actually changes at every router along the way.
DetailsLoad Balancing Protocols
Layer 4 vs. layer 7 balancing, NAT rewrites, and health checks — the actual packet and request flows that distribute traffic across a backend pool.
DetailsCongestion Control Visualized
How TCP probes for available bandwidth — slow start, congestion avoidance, and packet loss as the signal that tells senders when to back off.
DetailsHTTP/2 and HTTP/3
Streams, frames, and the transports underneath — what HTTP/2 multiplexing changes at the application layer and what moving to QUIC changes at the transport layer.
DetailsTLS Handshake Explained
The cryptographic negotiation inside TLS 1.3 — key exchange, certificate validation, and the single round trip that encrypts everything after it.
DetailsDNS Resolution Visualized
Follow a query from stub resolver to authoritative server — cache hits, recursive walking, TTL expiry, and the exact packet flow that turns a hostname into an IP.
DetailsTCP Three-Way Handshake Explained
SYN, SYN-ACK, ACK — the exact packets that open a TCP connection, the sequence numbers that synchronize both directions, and what each side actually stores.
DetailsDepth, delivered weekly
One technical dispatch a week — articles and episode notes before they go public.
One technical dispatch per week. No noise.