/* sk_buff key fields (simplified from include/linux/skbuff.h) */
struct sk_buff {
    /* Pointers into the data buffer */
    unsigned char   *head;      /* start of allocated buffer */
    unsigned char   *data;      /* start of valid data (moves on push/pull) */
    unsigned char   *tail;      /* end of valid data */
    unsigned char   *end;       /* end of allocated buffer */

    /* len = tail - data = bytes of valid packet data */
    unsigned int     len;
    unsigned int     data_len;  /* bytes in page fragments (non-linear data) */

    /* Protocol info */
    __be16           protocol;  /* ETH_P_IP, ETH_P_IPV6, etc. */
    __u8             pkt_type;  /* PACKET_HOST, BROADCAST, MULTICAST */

    /* Device info */
    struct net_device *dev;     /* ingress/egress network interface */

    /* Checksums */
    __wsum           csum;
    __u8             ip_summed; /* CHECKSUM_NONE/PARTIAL/COMPLETE/UNNECESSARY */

    /* Netfilter connection tracking */
    struct nf_conntrack *nfct;

    /* Transport header pointers */
    union { struct tcphdr *th; struct udphdr *uh; ... } h; /* L4 header */
    union { struct iphdr *iph; struct ipv6hdr *ipv6h; ... } nh; /* L3 */
    union { struct ethhdr *ethernet; unsigned char *raw; } mac; /* L2 */
};

/* Header manipulation — NO data copy required */
skb_push(skb, hdr_len);  /* data -= hdr_len  (add header at front) */
skb_pull(skb, hdr_len);  /* data += hdr_len  (remove header at front) */
skb_put(skb,  data_len); /* tail += data_len (add data at end) */
skb_trim(skb, len);      /* tail = data + len (remove tail data) */

/* Performance comparison */
Linux kernel stack:      ~1-3 Mpps per core (64-byte packets)
DPDK (PMD polling):     ~30-80 Mpps per core
VPP (vector processing): ~30-100 Mpps per core
XDP (eBPF in driver):   ~10-30 Mpps per core (with kernel features)

/* Kernel bypass mechanisms */

1. DPDK (Data Plane Development Kit):
   - PMD (Poll Mode Driver) replaces kernel driver
   - Application polls NIC directly — no interrupts ever
   - Hugepage memory for packet buffers (no TLB misses)
   - Runs in userspace — full application control
   Con: NIC is dedicated to DPDK, kernel cannot use it

2. AF_XDP (eXpress Data Path socket):
   - Kernel feature (5.x+)
   - Selective bypass: some queues to XDP, others to kernel
   - eBPF program in driver decides: XDP socket or kernel
   - Zero-copy between NIC and userspace possible
   - NIC still managed by kernel driver

3. XDP (eXpress Data Path):
   - eBPF program runs at NIC driver level (before sk_buff)
   - Can DROP, PASS, TX, REDIRECT
   - Native XDP: runs in driver ISR (fastest)
   - Generic XDP: runs after sk_buff allocation (slower, any NIC)
   - Use case: fast packet filtering, DDoS mitigation, load balancing

4. io_uring (for sockets):
   - Async I/O interface for socket operations
   - Reduces syscall overhead for high-connection-count servers

/* XDP program example (simplified) */
SEC("xdp")
int xdp_drop_icmp(struct xdp_md *ctx) {
    void *data     = (void *)(long)ctx->data;
    void *data_end = (void *)(long)ctx->data_end;
    struct ethhdr *eth = data;
    if (data + sizeof(*eth) > data_end) return XDP_DROP;
    if (eth->h_proto != htons(ETH_P_IP)) return XDP_PASS;
    struct iphdr *ip = data + sizeof(*eth);
    if (data + sizeof(*eth) + sizeof(*ip) > data_end) return XDP_DROP;
    if (ip->protocol == IPPROTO_ICMP) return XDP_DROP;
    return XDP_PASS;
}