search

cilium / pwru

Packet, where are you? -- eBPF-based Linux kernel networking debugger
Apache License 2.0
2.88k stars 176 forks source link

Can't see human readable drop reason in sk_skb_reason_drop #429

Closed DanPartelly closed 1 month ago

DanPartelly commented 1 month ago

I started exploring & using pwru through the official docker container released by cilium on Open Suse Tumbleweed several days ago. Initially, near sk_skb_reason_drop I had a human readable drop reason, such as SKB_DROP_REASON_NETFILTER_DROP. It vanished, the output for a dropped packet is now:

0xffff997d135cf300 17 ~system-x86:3433 4026531840 0 vgif_r2_1:13 0x0800 1500 100 172.16.0.1:0->172.16.0.2:0(icmp) sk_skb_reason_drop

I beleive this change occurred at the same time with a kernel upgrade to 6.11.0, but I cannot be sure exactly. Is this to be expected ?

Thanks you.

brb commented 1 month ago

pwru shows a drop reason only for kfree_skb_reason - https://github.com/cilium/pwru/blob/main/internal/pwru/output.go#L348. We could extend the if-clause to consider sk_skb_reason_drop too. Just that in addition from the BPF side we need to pass the third parameter (see how it's done for the 2nd param - https://github.com/cilium/pwru/blob/main/bpf/kprobe_pwru.c#L506).