.TH dropwatch "1" "Mar 2009" "Neil Horman"
.SH NAME
dropwatch \- kernel dropped packet monitoring utility
.SH SYNOPSIS
\fBdropwatch\fP [\fB\-l\fP \fImethod\fP | \fBlist\fP]
.SH DESCRIPTION
.B dropwatch
is an interactive utility for monitoring and recording packets that
are dropped by the kernel.
.SH OPTIONS
.TP
\fB\-l\fP \fImethod\fP | \fBlist\fP, \fB\-\-lmethod\fP \fImethod\fP | \fBlist\fP
Select the translation method to use when a drop alert arrives.  By default the
raw instruction pointer of a drop location is output, but by the use of the \fB\-l\fP
option, we can assign a translation method so that the instruction pointer can
be translated into function names.  Currently supported lookup \fImethods\fP are:
.RS
.TP
.B list
Show all supported methods.
.TP
.B kas
Use \fI/proc/kallsyms\fP to lookup instruction pointers to function mappings.
.RE
.SH INTERACTIVE COMMANDS
.TP
.B start
Tells the kernel to start reporting dropped packets.
.TP
.B stop
Tells the kernel to discontinue reporting dropped packets.
.TP
.B exit
Exits the \fBdropmonitor\fP program.
.TP
.B help
Displays summary of all commands.
.TP
\fBset alertlimit\fP \fIvalue\fP
Sets a triggerpoint to stop monitoring for dropped packets after \fIvalue\fP alerts
have been received.
.TP
.BR "set alertmode " "{ " summary " | " packet " }"
.I summary
- Default mode. A summary of recent packet drops is sent to user space. The
alert includes drop locations and number of drops in each location.

.I packet
- Each dropped packet is sent to user space. The alert includes the packet
itself and various metadata such as drop location and timestamp.
.TP
.BI "set trunc " "len"
Sets the truncation length. Reported packets will be truncated to length
\fIlen\fP. This setting is only applicable when \fIalertmode\fP is set to
\fIpacket\fP. By default packets are not truncated. A value of \fI0\fP disables
truncation.
.TP
.BI "set queue " "len"
Sets the queue length in the kernel. When \fIalertmode\fP is set to
\fIpacket\fP, the kernel queues dropped packets in a per-CPU drop list before
preparing a netlink message for each. This setting controls the queue's length.
By default this is limited by the kernel to 1,000 packets. Increasing this
value will increase the memory utilization of the system.
.TP
.BR "set sw " "{ " true " | " false " }"
Enables or disables the monitoring of software originated drops. By default
software originated drops are monitored.
.TP
.BR "set hw " "{ " true " | " false " }"
Enables or disables the monitoring of hardware originated drops. By default
hardware originated drops are not monitored.
.TP
.B show
Query existing configuration from the kernel and show it.
.TP
.B stats
Query statistics from the kernel and show it.

.I "Tail dropped"
- Number of packets that could not be enqueued to the per-CPU drop list(s).