Most of the protocol processing for incoming packets and for the outgoing packets during retransmission happens in the bottom-half handler net_bh(). In the current Linux kernel, proper accounting of this processing is not done. The network subsystem has been modified to do proper accounting. The Linux kernel already allows us to work out which socket file descriptor a network buffer (skbuff) structure belongs to, so we can always find the resource container for a packet by looking up the correct socket file. The accounting has been done by recording the timestamp counter (subsection 3.7) at the beginning and end of the bottom-half handler.
If the resource container corresponding to a network packet cannot be identified (eg. a packet to a port which no process is bound to), then it is charged to a separate container rc_system which is not part of the hierarchy rooted at rc_root (subsection 2.2). The number of bytes sent and received is also kept in the resource container as part of statistics.