Chapter 41. Capturing network packets
To debug network issues and communications, you can capture network packets. The following sections provide instructions and additional information about capturing network packets.
41.1. Using xdpdump to capture network packets including packets dropped by XDP programs
The xdpdump
utility captures network packets. Unlike the tcpdump
utility, xdpdump
uses an extended Berkeley Packet Filter(eBPF) program for this task. This enables xdpdump
to also capture packets dropped by Express Data Path (XDP) programs. User-space utilities, such as tcpdump
, are not able to capture these dropped packages, as well as original packets modified by an XDP program.
You can use xdpdump
to debug XDP programs that are already attached to an interface. Therefore, the utility can capture packets before an XDP program is started and after it has finished. In the latter case, xdpdump
also captures the XDP action. By default, xdpdump
captures incoming packets at the entry of the XDP program.
Red Hat provides xdpdump
as an unsupported Technology Preview.
Note that xdpdump
has no packet filter or decode capabilities. However, you can use it in combination with tcpdump
for packet decoding.
The procedure describes how to capture all packets on the enp1s0
interface and write them to the /root/capture.pcap
file.
Prerequisites
- A network driver that supports XDP programs.
-
An XDP program is loaded to the
enp1s0
interface. If no program is loaded,xdpdump
captures packets in a similar waytcpdump
does, for backward compatibility.
Procedure
To capture packets on the
enp1s0
interface and write them to the/root/capture.pcap
file, enter:#
xdpdump -i enp1s0 -w /root/capture.pcap
- To stop capturing packets, press Ctrl+C.
Additional resources
-
For further details about
xdpdump
, see thexdpdump(8)
man page. -
If you are a developer and you are interested in the source code of
xdpdump
, download and install the corresponding source RPM (SRPM) from the Red Hat Customer Portal.
41.2. Additional resources
- The How to capture network packets with tcpdump? knowledge base solution.