__skb_flow_dissect(9)

💅 __skb_flow_dissect(9) 💅

okay bestie, welcome to the Kernel API Manual, and the function we're about to dissect (ha, get it) is __skb_flow_dissect. and before you ask — yes, the name starts with underscores, yes that's a whole vibe, and yes you still have to type them all. no cap. 🫶

---

✨ NAME ✨

__skb_flow_dissect — extract the flow_keys struct and return it. that's literally it. that's the whole job. it gives you the struct. 🎀

---

🦋 SYNOPSIS 🦋

bool __skb_flow_dissect (const struct net *net , const struct sk_buff
*skb , struct flow_dissector *flow_dissector , void *target_container ,
const void *data , __be16 proto , int nhoff , int hlen , unsigned int
flags );

like, nine arguments. nine. she's high-maintenance but she's worth it, i promise 💜

---

🌸 ARGUMENTS 🌸

okay so every single one of these, one by one, no skipping, we don't do that here:

• net — the associated network namespace. and if it's NULL? it gets derived from skb instead. self-sufficient queen behavior 👑
• skb — the sk_buff we're extracting the flow from. you can pass NULL here, but only if you've specified everything else. like, she can be absent, but only if the rest of the squad shows up 🙈
• flow_dissector — the list of keys to dissect. this is the whole to-do list, basically 📋
• target_container — the target structure where the dissected values get put. the drop-off spot. the lil home for your results 🏠
• data — raw buffer pointer to the packet. if it's NULL, we use skb->data instead ✨
• proto — the protocol for which to get the flow. if data is NULL, we use skb->protocol 🦋
• nhoff — the network header offset. if data is NULL, we use skb_network_offset(skb) 📍
• hlen — the packet header length. if data is NULL, we use skb_headlen(skb) 📏
• flags — the flags that control the dissection process, e.g. FLOW_DISSECTOR_F_STOP_AT_ENCAP. these are the settings, the knobs, the little dials that change the whole mood 🎛️

---

🌈 DESCRIPTION 🌈

so the way that this works is: the function will try to retrieve individual keys into the target specified by flow_dissector — and it'll pull them from either the skbuff or a raw buffer specified by the rest parameters. either/or, bestie, it's flexible like that 💅

⚠️ real talk though: the caller must take care of zeroing target container memory. that's on you, not on her. she is not doing your homework. not me forgetting to zero and then debugging for three hours 😭

---

🔥 SEE ALSO 🔥

the extended universe, aka go read these too:

• Kernel file ./net/core/flow_dissector.c
• skb_flow_get_ports(9)
• skb_flow_get_icmp_tci(9)
• __skb_flow_dissect_batadv(9)
• __skb_get_hash_net(9)
• skb_get_poff(9)

---

okay that's the whole page, mwah 💖 this one's coming to you live from ./net/core, dated October 2026, and it's filed under __skb_flow_dissect(9) forever and always. go dissect some flows, you've got this 🧚 ⭐