Chapter 40. Capturing network packets

To debug network issues and communications, you can capture network packets. The following sections provide instructions and additional information about capturing network packets.

40.1. Using xdpdump to capture network packets including packets dropped by XDP programs

The xdpdump utility captures network packets. Unlike the tcpdump utility, xdpdump uses an extended Berkeley Packet Filter(eBPF) program for this task. This enables xdpdump to also capture packets dropped by Express Data Path (XDP) programs. User-space utilities, such as tcpdump, are not able to capture these dropped packages, as well as original packets modified by an XDP program.

You can use xdpdump to debug XDP programs that are already attached to an interface. Therefore, the utility can capture packets before an XDP program is started and after it has finished. In the latter case, xdpdump also captures the XDP action. By default, xdpdump captures incoming packets at the entry of the XDP program.


Red Hat provides xdpdump as an unsupported Technology Preview.

Note that xdpdump has no packet filter or decode capabilities. However, you can use it in combination with tcpdump for packet decoding.

The procedure describes how to capture all packets on the enp1s0 interface and write them to the /root/capture.pcap file.


  • A network driver that supports XDP programs.
  • An XDP program is loaded to the enp1s0 interface. If no program is loaded, xdpdump captures packets in a similar way tcpdump does, for backward compatibility.


  1. To capture packets on the enp1s0 interface and write them to the /root/capture.pcap file, enter:

    # xdpdump -i enp1s0 -w /root/capture.pcap
  2. To stop capturing packets, press Ctrl+C.

Additional resources

  • For further details about xdpdump, see the xdpdump(8) man page.
  • If you are a developer and you are interested in the source code of xdpdump, download and install the corresponding source RPM (SRPM) from the Red Hat Customer Portal.

40.2. Additional resources