1dwdump(1) General Commands Manual dwdump(1)
2
3
4
6 dwdump - dump kernel dropped packets to a file
7
9 dwdump [ OPTIONS ]
10
11
12
14 -w, --write FILE
15 Dump packets to provided file in pcap format. Defaults to stan‐
16 dard output.
17
18
19 -t, --trunc LENGTH
20 Ask the kernel to truncate packets to provided length. Defaults
21 to no truncation.
22
23
24 -q, --query
25 Query the kernel for current configuration and exit.
26
27
28 -l, --limit LIMIT
29 Ask the kernel to set the per-CPU packet queue limit to provided
30 limit. Defaults to 1,000 packets.
31
32
33 -p, --passive
34 Only listen on notified packets with no configuration. This is
35 useful if the kernel is already monitoring dropped packets and
36 you only want to open another listening socket.
37
38
39 -s, --stats
40 Query the kernel for statistics and exit.
41
42
43 -b, --bufsize SIZE
44 Set the socket's receive buffer to provided size. Defaults to
45 1MB.
46
47
48 -o, --origin { sw | hw }
49 Ask the kernel to only monitor software or hardware originated
50 drops. Defaults to both. See devlink-trap(8) for details on how
51 to get hardware originated drops to the kernel.
52
53
54 -e, --exit
55 Ask the kernel to stop monitoring and exit.
56
57
59 dwdump -w drops.pcap
60 Dump dropped packets to a file.
61
62 dwdump | tshark -V -r -
63 Pipe dropped packets to Wireshark.
64
65 dwdump -o sw -w drops.pcap
66 Only monitor software originated drops.
67
68 dwdump -q
69 Query current configuration from the kernel and exit.
70
71
73 dropwatch(1), devlink-trap(8), tshark(1),
74
75
76
77Ido Schimmel Jan 2020 dwdump(1)