sk_filter_trim_cap(9)
β¨ sk_filter_trim_cap β¨
okay bestie, welcome to the sk_filter_trim_cap page π
this is a kernel API manpage (like, from the Kernel API Manual, iykyk) and it's lowkey about running a packet through a socket filter. let's get into it π«Ά
πΈ SYNOPSIS πΈ
enum skb_drop_reason sk_filter_trim_cap (struct sock *sk , struct
sk_buff *skb , unsigned int cap );
literally the whole vibe in one line, no cap π
π¦ ARGUMENTS π¦
skβ the sock that's associated with thesk_buff, like its little home base πskbβ the buffer you're filtering, the main character of this whole operation β¨capβ a limit on how short the eBPF program is allowed to trim the packet. so the program can trim, but it can't go shorter than this, periodt π«
π DESCRIPTION π
so here's what happens, bestie: it runs the eBPF program, and then it cuts skb->data down to the correct size that the program returned βοΈβ¨
a couple things to know:
- if
pkt_lenis0, we toss the packet. bye bye ππ - if
skb->lenis smaller thanpkt_len, we just keep the wholeskb->dataβ no trimming, we're not gonna invent bytes that don't exist π
this is the socket level wrapper to bpf_prog_run π§ and it returns 0 if the packet should be accepted, or a drop_reason if the packet should be tossed π₯
ngl the return value is doing double duty here β0means "keep it", adrop_reasonmeans "yeet it", so always check before you celebrate π
π SEE ALSO π
- the kernel file
./net/core/filter.cπ bpf_convert_filter(9)bpf_check_classic(9)sk_filter_release_rcu(9)sk_filter_release(9)bpf_prog_create(9)bpf_prog_create_from_user(9)sk_attach_filter(9)xdp redirect(9)bpf_skb_meta_pointer(9)bpf_dynptr_from_skb_meta(9)bpf_xdp_pull_data(9)bpf_icmp_send(9)
like, go read those too, they're all part of the friend group fr fr π
okay that's the whole page bestie!! this lil gem lives over in ./net/core and it's dated October 2026, and yeah β it's still calling itself sk_filter_trim_cap(9) at the bottom too. iconic behavior honestly π
β say hi to your packets for me π¦
π¦ where this page comes from
- nixpkgs unstable: linux-manual 7.3.1
- π girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on : a language model's rewrite of the original, under its terms