sk_filter_trim_cap(9)

πŸ“¦ version 7.3.1, in nixpkgs unstable

✨ sk_filter_trim_cap ✨

okay bestie, welcome to the sk_filter_trim_cap page πŸ’… this is a kernel API manpage (like, from the Kernel API Manual, iykyk) and it's lowkey about running a packet through a socket filter. let's get into it 🫢


🌸 SYNOPSIS 🌸

enum skb_drop_reason sk_filter_trim_cap (struct sock *sk , struct
sk_buff *skb , unsigned int cap );

literally the whole vibe in one line, no cap πŸŽ€


πŸ¦‹ ARGUMENTS πŸ¦‹

  • sk β€” the sock that's associated with the sk_buff, like its little home base πŸ’–
  • skb β€” the buffer you're filtering, the main character of this whole operation ✨
  • cap β€” a limit on how short the eBPF program is allowed to trim the packet. so the program can trim, but it can't go shorter than this, periodt 🚫

πŸ‘‘ DESCRIPTION πŸ‘‘

so here's what happens, bestie: it runs the eBPF program, and then it cuts skb->data down to the correct size that the program returned βœ‚οΈβœ¨

a couple things to know:

  • if pkt_len is 0, we toss the packet. bye bye πŸ‘‹πŸ’€
  • if skb->len is smaller than pkt_len, we just keep the whole skb->data β€” no trimming, we're not gonna invent bytes that don't exist πŸ™ˆ

this is the socket level wrapper to bpf_prog_run 🧚 and it returns 0 if the packet should be accepted, or a drop_reason if the packet should be tossed πŸ”₯

ngl the return value is doing double duty here β€” 0 means "keep it", a drop_reason means "yeet it", so always check before you celebrate πŸŽ€

🌈 SEE ALSO 🌈

like, go read those too, they're all part of the friend group fr fr πŸ’œ


okay that's the whole page bestie!! this lil gem lives over in ./net/core and it's dated October 2026, and yeah β€” it's still calling itself sk_filter_trim_cap(9) at the bottom too. iconic behavior honestly πŸ’…β­ say hi to your packets for me πŸ¦‹

πŸ“¦ where this page comes from