dwdump(1)

📦 version 1.5.5, in debian bookworm, debian trixie, epel 9, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

✨ dwdump(1) ✨

okay so bestie, welcome to dwdump — it's a little General Commands Manual moment, and honestly? it's giving main character energy. basically it's the tool you call when you wanna dump kernel dropped packets to a file. that's the whole vibe. packets that got yeeted by the kernel? we're catching them 💅

🌸 NAME 🌸

dwdump — dump kernel dropped packets to a file 🫶

🎀 SYNOPSIS 🎀

dwdump [ OPTIONS ]

that's it. no positional args, no drama, just vibes and options ✨

💖 OPTIONS 💖

okay bestie here's the menu, and no we are not skipping any of them, every single flag is iconic in its own way:

  • -w, --write FILE — dumps the packets into the file you give it, in pcap format. if you don't say anything, it defaults to standard output. lowkey the most used one fr fr.
  • -t, --trunc LENGTH — asks the kernel to truncate packets down to the length you provide. defaults to no truncation at all, so full packets by default.
  • -q, --query — queries the kernel for the current configuration and then exits. like a lil vibe check on the kernel's settings 💅
  • -l, --limit LIMIT — asks the kernel to set the per-CPU packet queue limit to your provided limit. defaults to 1,000 packets. don't be greedy bestie.
  • -p, --passive — only listens on notified packets with no configuration done. this is useful if the kernel is already monitoring dropped packets and you just want to open another listening socket. so like, you're just pulling up a chair, not rearranging the furniture 🪑
  • -s, --stats — queries the kernel for statistics and exits. numbers, bestie. we love numbers.
  • -b, --bufsize SIZE — sets the socket's receive buffer to the size you provide. defaults to 1MB. give it room to breathe ✨
  • -o, --origin { sw | hw } — asks the kernel to only monitor software or hardware originated drops. defaults to both. see devlink-trap(8) for details on how to get hardware originated drops to the kernel. iykyk 👑
  • -e, --exit — asks the kernel to stop monitoring and exit. the graceful lil goodbye 👋

🌈 EXAMPLES 🌈

these are literally the cutest lil demos, pls enjoy:

dwdump -w drops.pcap

Dump dropped packets to a file. classic. the go-to. 🍓

dwdump | tshark -V -r -

Pipe dropped packets to Wireshark. pipe it bestie, pipe it 🔥

dwdump -o sw -w drops.pcap

Only monitor software originated drops. hardware found irrelevant 💀

dwdump -q

Query current configuration from the kernel and exit. in and out, no notes.

🦋 SEE ALSO 🦋

go read these too, they're the friend group:

heads up bestie: -p / --passive does no configuration at all, it only listens on notified packets — that's on purpose, not a bug. and -o defaults to both sw and hw, so if you only want one of them you actually have to say so. no cap. 💜

and that's the whole page, periodt. this lil icon was written by Ido Schimmel back in Jan 2020, and it lives in the General Commands Manual — dwdump(1) forever and always 💖✨🎀

📦 where this page comes from