Mbufs: Memory Buffers

The main use of mbufs is to hold the user data that travels from the process to the network interface, and vice versa. But mbufs are also used to contain a variety of other miscellaneous data: source and destination addresses, socket options, and so on.

1. If m_flags equals 0, the mbuf contains only data. There is room in the mbuf for up to 108 bytes of data (the m_dat array). The m_data pointer points somewhere in this 108-byte buffer. We show it pointing to the start of the buffer, but it can point anywhere in the buffer. The m_len member specifies the number of bytes of data, starting at m_data. 
   there are six members in the m_hdr structure, and its total size is 20 bytes. When we look at the C definition of this structure we'll see that the first four members occupy 4 bytes each and the last two occupy 2 bytes each. We don't try to differentiate between the 4-byte members and the 2-byte members.
2. The second type of mbuf has an m_flags value of M_PKTHDR, specifying a packet header, that is, the first mbuf describing a packet of data. The data is still contained within the mbuf itself, but because of the 8 bytes taken by the packet header, only 100 bytes of data fit within this mbuf (in the m_pktdat array).
   The m_pkthdr.len value is the total length of all the data in the chain mbuf for this packet: the sum of the m_len values for all the mbufs linked through the m_next pointer . The m_pkthdr.rcvif member is not used for output packets, but for received packets contains a pointer to the received interface's ifnet structure
3. The next type of mbuf does not contain a packet header (M_PKTHDR is not set) but contains more than 208 bytes of data, so an external buffer called a cluster is used (M_EXT is set). Room is still allocated in the mbuf itself for the packet header structure, but it is unused. Instead of using multiple mbufs to contain the data (the first with 100 bytes of data, and all the rest with 108 bytes of data each), Net/3 allocates a cluster of size 1024 or 2048 bytes. The m_data pointer in the mbuf points somewhere inside this cluster.
4. The final type of mbuf contains a packet header and contains more than 208 bytes of data. Both M_PKTHDR and M_EXT are set.
   

There are numerous additional points we need to make about

1. The size of the mbuf structure is always 128 bytes. This means the amount of unused space following the m_ext structure in the two mbufs  is 88 bytes (128 – 20 – 8 –12).
2. A data buffer with an m_len of 0 bytes is OK since some protocols (e.g., UDP) allow 0-length records.
3. In each of the mbufs we show the m_data member pointing to the beginning of the corresponding buffer (either the mbuf buffer itself or a cluster). This pointer can point anywhere in the corresponding buffer, not necessarily the front.
4. Mbufs with a cluster always contain the starting address of the buffer (m_ext.ext_buf) and its size (m_ext.ext_size). We assume a size of 2048 throughout this text. The m_data and m_ext. ext_buf members are not the same (as we show) unless m_data also points to the first byte of the buffer. The third member of the m_ext structure, ext_free, is not currently used by Net/3.
5. The m_next pointer links together the mbufs forming a single packet (record) into an mbuf chain The m_nextpkt pointer links multiple packets (records) together to form a queue of mbufs. Each packet on the queue can be a single mbuf or an mbuf chain. The first mbuf of each packet contains a packet header. If multiple mbufs define a packet, the m_nextpkt member of the first mbuf is the only one used—the m_nextpkt member of the remaining mbufs on the chain are all null pointers.

The first mbuf with the packet header for the UDP datagram has a type of MT_DATA, but the first mbuf with the packet header for the TCP segment has a type of MT_HEADER. This is a side effect of the different way UDP and TCP prepend the headers to their data, and makes no difference. Mbufs of these two types are essentially the same. It is the m_flags value of M_PKTHDR in the first mbuf on the chain that indicates a packet header.

This structure can be examined with the netstat -m command