PDP-01 · Programmable Data Planes
Follow one packet through the kernel, step by step.
Every request you send crosses a path you cannot see. This course opens it: the driver, the socket buffers, the protocol stack, and the way back.
You build: a traced packet path on a live Linux host, with per-stage timings.
Prefer to be taught it live? Linux Network Stack Architecture & Sockets (NET-101, 4 days) is the same material delivered in a scheduled cohort by an instructor, in person or online. See the live course · Live dates
Promise
Follow a single packet from the NIC driver to a socket and back, and say what happens at each step.
Prerequisites
none beyond basic Linux and TCP/IP.
Units
1. Entry and link layer ch 01–09
where the stack starts, driver handoff, Ethernet processing.
2. IP and transport ch 10–19
routing lookup, transport dispatch, the TCP life cycle from handshake to close.
3. The socket boundary ch 20–22
how send and receive cross from user space and wait in queues.
4. Filtering and isolation ch 23–26
netfilter hooks, connection tracking, namespaces, virtual devices.
5. Hooks and debugging ch 27–30
XDP at the earliest hook, tracing, and a summary of the path.
Labs
Each lab names its environment and a pass check. Labs are not marked complete on "it ran" — the pass check has to hold.
| Lab | What you do | Environment |
|---|---|---|
| PDP-01ach 05–09 | Trace one ICMP echo through the stack with a kernel tracerPass check: You name at least 6 hooks in order, with timestamps | vm60 min |
| PDP-01bch 23–24 | Build a netns topology and add a netfilter drop rulePass check: Ping fails on the rule, passes after removal | sim60 min |
| PDP-01cch 27 | Attach a minimal XDP program and count packetsPass check: Counter equals packets sent | vm45 min |
Capstone project · CAP-01
Packet Path Report · 1 week
An engineer must explain a latency symptom to a non-network team.
Choose one request path on a Linux host. Trace it end to end with eBPF and counters. Quantify each stage. Identify the one stage you would change first.
Deliverables: Trace data, scripts, a 4-page report with one diagram.
Outcomes
- I can name the function-level hooks a received packet passes through.
- I can explain how a TCP segment reaches a waiting `recv()`.
- I can use netfilter and conntrack to explain why a packet was dropped.
- I can isolate a test network with namespaces and virtual devices.
Also in
How it runs
Work through the units in order. Each unit groups the chapters of the study guide with its share of the labs. You can start any time; there is no cohort date and nothing expires.
Labs run in a VM, a container, a simulator or on real hardware, and the card above names which. Where a lab needs hardware — an RDMA NIC, a programmable switch model, an FPGA — there is a simulator fallback so you are never blocked by equipment.
Questions
Do I get a certificate?
You get a completion record for the course. Path badges and project credentials are earned by passing the labs and the project review, not by attendance.
Can my team take this together?
Yes — and if you would rather have it delivered live, with the instructor in the room, this course also exists as a scheduled live cohort. See the live dates.
How long does it take?
≈ 30 h of study including the labs. Most engineers take it part-time over a few weeks.