The skb (socket buffer) section contains metadata about the Linux kernel struct sk_buff data structure, including checksums, GSO information, and reference counts.
Fields VLAN hardware acceleration information when VLAN data is in metadata rather than the packet.
Socket buffer metadata including lengths, checksums, hash, and priority.
Data and reference count information for the skb.
Generic Segmentation Offload (GSO) information.
SkbVlanAccelEvent Show VLAN Acceleration Fields
Tag protocol identifier (TPID). Common values: 0x8100 (802.1Q), 0x88a8 (802.1ad).
Priority Code Point (0-7). Also called Class of Service (CoS).
Drop Eligible Indicator - whether frame can be dropped under congestion.
vlan_accel (ethertype IPv4 (0x0800) vlan 100 p 5 DEI)
Total packet length in bytes.
Length of data in paged buffer area (non-linear data).
Packet hash value used for flow distribution.
Checksum status:
0 = None1 = Unnecessary (validated by hardware)2 = Complete (full checksum in csum)3 = Partial (checksum offload parameters) Checksum value (when ip_summed is 2) or checksum parameters:
(start << 16) | offset when ip_summed is 3 Checksum level for encapsulated packets (when ip_summed is 1).
skb [csum none hash 0x1234 len 98 priority 0] skb [csum unnecessary (level 0) len 1500 data_len 1460 priority 0] skb [csum partial (start 14 off 16) hash 0xabcd len 1500 priority 0]
SkbDataRefEvent Show Data Reference Fields
Payload reference only - no header data.
Whether this skb is a clone of another skb.
Fast clone state:
0 = Not a fast clone1 = Unavailable for fast cloning2 = Fast clone Number of users referencing this skb.
skb [users 1 dataref 1] skb [cloned fclone 2 users 2 dataref 1] skb [nohdr users 1 dataref 2]
SkbGsoEvent GSO type flags. See SKB_GSO_* in kernel’s include/linux/skbuff.h:
0x1 = TCPV40x2 = UDP0x4 = DODGY0x8 = TCP_ECNAnd more…
GSO flags. See SKBFL_* in kernel’s include/linux/skbuff.h.
GSO segment size in bytes (MSS).
Number of segments this packet will be split into.
Number of fragments in skb_shared_info->frags.
gso [type 0x1 size 1448] gso [type 0x1 flags 0x2 frags 3 segs 10 size 1448]
Example JSON Complete SKB with All Fields { "skb" : { "vlan_accel" : { "proto" : 33024 , "pcp" : 5 , "dei" : true , "vid" : 100 }, "meta" : { "len" : 1500 , "data_len" : 0 , "hash" : 305419896 , "ip_summed" : 1 , "csum" : 0 , "csum_level" : 0 , "priority" : 0 }, "data_ref" : { "nohdr" : false , "cloned" : false , "fclone" : 0 , "users" : 1 , "dataref" : 1 }, "gso" : { "type" : 1 , "flags" : 0 , "size" : 1448 , "segs" : 0 , "frags" : 0 } } }
{ "skb" : { "meta" : { "len" : 98 , "data_len" : 0 , "hash" : 0 , "ip_summed" : 0 , "csum" : 0 , "csum_level" : 0 , "priority" : 0 }, "data_ref" : { "nohdr" : false , "cloned" : false , "fclone" : 0 , "users" : 1 , "dataref" : 1 } } }
Cloned SKB { "skb" : { "meta" : { "len" : 1500 , "data_len" : 0 , "hash" : 2863311530 , "ip_summed" : 1 , "csum" : 0 , "csum_level" : 0 , "priority" : 0 }, "data_ref" : { "nohdr" : false , "cloned" : true , "fclone" : 2 , "users" : 2 , "dataref" : 1 } } }
When This Section Appears The skb section is populated when:
The skb collector is enabled (-c skb)
The probe has access to an struct sk_buff * parameter
The skb is valid and readable
Not all fields appear in every event. Fields with default or invalid values are automatically hidden from the output.
VLAN Hardware Acceleration When VLAN tags are handled by hardware (“VLAN acceleration”), the VLAN information is stored in skb metadata instead of being part of the packet data. The vlan_accel field captures this metadata.
When VLAN acceleration is not used, VLAN information appears in the packet section instead. 