dropwatch(1)

💖 dropwatch — the girlies' guide to catching your kernel dropping packets 💖

okay so bestie. this is dropwatch, a page from the General Commands Manual, and honestly it's giving "quiet little utility that will absolutely save your networking career". it's an interactive tool for watching and recording the packets your kernel is just... dropping. rudely. on the floor. no cap. 💅

✨ NAME ✨

dropwatch — kernel dropped packet monitoring utility 🫶

🌸 SYNOPSIS 🌸

dropwatch [-l method | list]

that's it. that's the whole vibe. one flag. iconic.

🦋 DESCRIPTION 🦋

dropwatch is an interactive utility for monitoring and recording packets that are dropped by the kernel. she sits there, you talk to her, she tells you what the kernel threw away. lowkey the most emotionally intelligent kernel tool out there 💖

🎀 OPTIONS 🎀

• -l method, --lmethod method | list — picks the translation method used whenever a drop alert shows up. by default you just get the raw instruction pointer of a drop location dumped at you (meh, mysterious). but with -l you can assign a translation method so that instruction pointer gets turned into actual function names. glow-up fr. currently supported lookup methods are:
  • list — shows all the supported methods. your little menu of options 🍓
  • kas — uses /proc/kallsyms to look up instruction pointers → function mappings.

👑 INTERACTIVE COMMANDS 👑

these are the things you type once you're in the program. it's a conversation bestie, use your words 💬

• start — tells the kernel to start reporting dropped packets. go time ⭐
• stop — tells the kernel to discontinue reporting dropped packets. nap time 😴
• exit — exits the dropmonitor program. bye babes 🦋
• help — displays a summary of all commands. the built-in group chat search 💜
• set alertlimit value — sets a triggerpoint to stop monitoring for dropped packets after value alerts have been received. like a lil "okay that's enough, i've seen enough" limit 🙈
• set alertmode { summary | packet } — picks how the alerts come at you:
  • summary — default mode. a summary of recent packet drops is sent to user space. the alert includes drop locations and number of drops in each location. tl;dr: the highlights reel ✨
  • packet — every single dropped packet is sent to user space. the alert includes the packet itself and various metadata such as drop location and timestamp. the full unhinged director's cut, every detail, no skips 🔥
• set trunc len — sets the truncation length. reported packets will be truncated to length len. this setting is only applicable when alertmode is set to packet. by default packets are not truncated. a value of 0 disables truncation. so like, 0 = full packet, no scissors ✂️
• set queue len — sets the queue length in the kernel. when alertmode is set to packet, the kernel queues dropped packets in a per-CPU drop list before preparing a netlink message for each. this setting controls that queue's length. by default this is limited by the kernel to 1,000 packets.

⚠️ increasing this value will increase the memory utilization of the system. it's giving "bigger queue, bigger appetite". be mindful bestie 😭

• set sw { true | false } — enables or disables the monitoring of software originated drops. by default software originated drops are monitored. ✅ on by default, main character behaviour
• set hw { true | false } — enables or disables the monitoring of hardware originated drops. by default hardware originated drops are not monitored. off by default, she's shy 🙈
• show — query existing configuration from the kernel and show it. vibe check the current setup 💅
• stats — query statistics from the kernel and show it.
  • Tail dropped — number of packets that could not be enqueued to the per-CPU drop list(s). aka the ones that didn't even make it into the queue 😭

and that's the whole page bestie!! now go catch those drops before they catch you 💖✨

this page was written by Neil Horman, dated Mar 2009 — a legend who was out here documenting kernel packet drops before it was cool. mwah. 🫶👑