Sorry, I am working on this right now...
The packet data received by NIC is held by sk_buff(). I'm curious how packets travels from NIC to user space programs.