What is eating my traffic? Packet thieves revealed
summary
Linux drops or steals packets at many concrete points: NIC hardware (SR‑IOV, VF assignment, hardware filters or queue drops — check with ethtool -S), kernel drivers (ip -s shows driver stats), XDP/BPF programs (can drop, redirect or modify before the kernel and are listed with bpftool/netlink), traffic control (tc can police, drop or mirror packets), bridges/VLANs/master interfaces, and firewalls (iptables/nftables/ebtables). tcpdump only sees packets after XDP and before tc; dropwatch and perf help locate kernel drops.
AI-written summary · about
chapters (9)
- 0:00Intro
- 0:27Network Interfaces
- 5:48Stolen Interfaces
- 12:22Rx Path: NIC
- 16:43Rx Path: Driver
- 22:05Rx Path: Traffic Control
- 25:20Rx Path: Stacked Interfaces
- 30:41Rx Path: TCP/IP
- 36:58Packet Capture
related talks
34mStrategies for Rate Limiting Network Packet Ingress
30mLessons From Defending The Indefensible
33mWhose Packet Is It Anyway? Life of a Packet Through a Service Mesh
36mThe black art of network performances
26mNetwork monitoring with FOSS
36mOffloading Network Traffic Classification to Hardware
38mPacket Capture the Flag
34mIt's Not Always the Network (But Here's How to Prove It): Kubernetes Packet...