nf_hook_egress(9)

💅 nf_hook_egress 💅

okay bestie, welcome to nf_hook_egress(9) from the Kernel API Manual — yes it's a real manual page, yes it's kind of iconic, and yes we're gonna get through it together 🫶

---

✨ NAME ✨

nf_hook_egress — classify packets before transmission 💌 (that's it, that's the whole vibe: sort your packets before they leave the house)

---

🌸 SYNOPSIS 🌸

struct sk_buff * nf_hook_egress (struct sk_buff *skb , int *rc , struct
net_device *dev );

three args, one return, no cap ✨

---

🎀 ARGUMENTS 🎀

• skb — the packet to be classified, literally the main character of this whole function 💖
• rc — a result code pointer; this is the code that shall be returned by __dev_queue_xmit on failure, so it's the "if this goes wrong, here's what we say" slot 🫶
• dev — the netdev whose egress hooks shall be applied to skb; like, which interface's hooks are we running here 👑

---

🦋 DESCRIPTION 🦋

First thing first, bestie: the caller must hold rcu_read_lock. Not optional. Not a suggestion. Hold it. 🙈

okay so here's the lore. On ingress, packets are classified first by tc, then by netfilter. On egress, the order is reversed — for symmetry 💅 (the kernel is very into symmetry, we love a consistent queen).

Conceptually, tc and netfilter can be thought of as layers, with netfilter layered above tc: when tc redirects a packet to another interface, netfilter is not applied, because the packet is on the tc layer. so close to netfilter yet so far 😭

The nf_skip_egress flag controls whether netfilter is applied on egress. It is updated by __netif_receive_skb_core and __dev_queue_xmit when the packet passes through tc and netfilter. Because __dev_queue_xmit may be called recursively by tunnel drivers such as vxlan, the flag is reverted to false after sch_handle_egress. This ensures that netfilter is applied both on the overlay and the underlying network 🌈✨ (double the network, double the netfilter, we ate)

lowkey the flag reset is the whole plot twist — no flag reset, no overlay + underlay coverage. respect the flag 🫡

---

🌟 RETURN 🌟

• skb on success 🎉
• NULL if the packet was consumed or filtered 💀 (it's gone, it's not coming back, we don't talk about it)

---

💜 SEE ALSO 💜

Kernel file ./include/linux/netfilter_netdev.h — go read it, it's giving source of truth 📖✨

---

okay that's the page!! sourced straight from ./include/linux, dated October 2026, and yeah she's still filed under nf_hook_egress(9) because some things never change 🧚💖 mwah, go classify some packets 💅