hi all: The job of pskb_may_pull is to make sure that the area pointed to by skb->data contains a block of data at least as big as the IP header, since each IP packet (fragments included) must include a complete IP header.When we receive a packet , the kernel will call the pkb_may_pull(), it looks like the following in line 395: 373 /* 374 * Main IP Receive routine. 375 */ 376 int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev) 377 { 378 const struct iphdr *iph; 379 u32 len; 380 381 /* When the interface is in promisc. mode, drop all the crap 382 * that it receives, do not try to analyse it. 383 */ 384 if (skb->pkt_type == PACKET_OTHERHOST) 385 goto drop; 386 387 388 IP_UPD_PO_STATS_BH(dev_net(dev), IPSTATS_MIB_IN, skb->len); 389 390 if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL) { 391 IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_INDISCARDS); 392 goto out; 393 } 394 395 if (!pskb_may_pull(skb, sizeof(struct iphdr))) 396 goto inhdr_error; 397 398 iph = ip_hdr(skb); 399 And the definition of pkb_may_pull() looks like the following: 1708 static inline int pskb_may_pull(struct sk_buff *skb, unsigned int len) 1709 { 1710 if (likely(len <= skb_headlen(skb))) 1711 return 1; 1712 if (unlikely(len > skb->len)) 1713 return 0; 1714 return __pskb_pull_tail(skb, len - skb_headlen(skb)) != NULL; 1715 } I just want to know which situation make the skb->data contains a block of data less than the IP header? I think this packet can't send by kernel at all. Thank you.