Watch Where the Linux Kernel Drops a Packet
linux.die.net
Watch Where the Linux Kernel Drops a Packet
1–10 of 21 posts
Re: Watch Where the Linux Kernel Drops a Packet
#2I recently read a blogpost about post-mortem in google engineering blog. They also mentioned this tool to detect dropped dns packages. Generally, when I see something new or something I never heard of before, when I see it two times at least within frequent time intervals, it almost becomes impossible to forget that for me. Brain is weird.
Re: Watch Where the Linux Kernel Drops a Packet
#3Would something similar be achievable using eBPF?
Re: Watch Where the Linux Kernel Drops a Packet
#4Link to the GitHub repo:
Re: Watch Where the Linux Kernel Drops a Packet
#5I setup the AUR package [0] for this while troubleshooting some dropped UDP data and was kind of shocked at how hard this tool was to used. It reported tons of drops everywhere that I couldn't observe from userspace on any of my tests.
Is anyone aware of an overview showing how to approach and get started with this tool?
Re: Watch Where the Linux Kernel Drops a Packet
#6I recently read a blogpost about post-mortem in google engineering blog. They also mentioned this tool to detect dropped dns packages. Generally, when I see something new or something I never heard of before, when I see it two times at least within frequent time intervals, it almost becomes impossible to forget that for me. Brain is weird.
I’m guessing this is posted BECAUSE of that article.
Re: Watch Where the Linux Kernel Drops a Packet
#7dropwatch is great, I've used it to debug why our router firmware drops packets. It has some issues (I really need to verify which are still present and file them) but it works.
You can also achieve mostly the same effect with perf via the skb:kfree_skb tracepoint. This has less performance impact, better post-processing options, and doesn't require the dropwatch specific kernel config option (NET_DROP_MONITOR).
Re: Watch Where the Linux Kernel Drops a Packet
#8Link to the GitHub repo: https://github.com/nhorman/dropwatch
Note there's also kernel side code for this. Theoretically it's generic, but practically it was written specifically for dropwatch and dropwatch is the only user of it that I am aware of.
https://github.com/torvalds/linux/blob/master/net/core/drop_...
Re: Watch Where the Linux Kernel Drops a Packet
#9Would something similar be achievable using eBPF?
Yes, you can attach an eBPF program to the skb:kfree_skb tracepoint.
For example: perf record -e skb:kfree_skb
Re: Watch Where the Linux Kernel Drops a Packet
#10Is it for any layer? If traffic is dropped at the frame/L2 level or at the tcp layer, would this show?