Skip to main content
The dev (device) section provides information about network interfaces involved in packet processing.

​
Fields

​
name
string
required
Network device name from dev->name.Examples: "eth0", "wlan0", "br0", "veth1234"
​
ifindex
u32
required
Interface index from dev->ifindex.This is the kernel’s numeric identifier for the device, used by APIs like ip link.
​
rx_ifindex
u32
Receive interface index from skb->skb_iif.This is the interface where the packet was originally received, which may differ from the current device (e.g., after forwarding or bridging).

​
Display Format

if {ifindex} ({name}) [rxif {rx_ifindex}]

​
Examples

Single interface: 
if 2 (eth0)
With receive interface: 
if 3 (eth1) rxif 2
Virtual interface: 
if 10 (veth12345678)
Bridge: 
if 5 (br0) rxif 2

​
Example JSON

​
Basic Interface

{
  "dev": {
    "name": "eth0",
    "ifindex": 2,
    "rx_ifindex": null
  }
}

​
Interface with RX Info

{
  "dev": {
    "name": "eth1",
    "ifindex": 3,
    "rx_ifindex": 2
  }
}

​
Virtual Ethernet Pair

{
  "dev": {
    "name": "veth0a1b2c3d",
    "ifindex": 12,
    "rx_ifindex": null
  }
}

​
Bridge Interface

{
  "dev": {
    "name": "br0",
    "ifindex": 5,
    "rx_ifindex": 2
  }
}

​
Complete Event Example

{
  "common": {
    "timestamp": 7322460997041,
    "smp_id": 1,
    "task": {
      "pid": 0,
      "tgid": 0,
      "comm": "swapper/1"
    }
  },
  "kernel": {
    "symbol": "__netif_receive_skb_core",
    "probe_type": "kprobe"
  },
  "netns": {
    "cookie": 4026531840,
    "inum": 4026531840
  },
  "dev": {
    "name": "eth0",
    "ifindex": 2,
    "rx_ifindex": null
  },
  "packet": {
    "len": 98,
    "capture_len": 98,
    "data": "...(base64)..."
  }
}

​
When This Section Appears

The dev section is populated when:
  • The probe has access to a struct net_device * parameter
  • The device pointer is valid and readable
  • The collector can retrieve device information
This typically occurs at probe points that handle network devices, such as:
  • __netif_receive_skb_core
  • dev_queue_xmit
  • dev_hard_start_xmit
  • Bridge and routing functions

​
Receive Interface vs. Current Interface

The distinction between ifindex and rx_ifindex is important: ifindex (current device):
  • The device currently processing the packet
  • Changes as packet moves through the stack
  • Used for output decisions
rx_ifindex (receive device):
  • The device where packet entered the system
  • Preserved throughout processing
  • Used for policy decisions (e.g., firewall rules)

​
Example: Forwarded Packet

{
  "dev": {
    "name": "eth1",
    "ifindex": 3,
    "rx_ifindex": 2
  }
}
This indicates:
  • Packet was received on interface 2 (rx_ifindex)
  • Packet is now being processed on interface 3 (ifindex)
  • Packet is being forwarded from eth0 (ifindex 2) to eth1 (ifindex 3)

​
Mapping to System Interfaces

Use ip link to map interface indexes to names: 
$ ip link show
1: lo: <LOOPBACK,UP,LOWER_UP> ...
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> ...
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> ...
5: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> ...
The numbers (1, 2, 3, 5) are the ifindex values.

​
Display with Network Namespace

The dev section is often displayed on the same line as the netns section: 
ns 4026531840 if 2 (eth0)
ns 0x12345678/4026532448 if 10 (veth1234) rxif 2
The name field may be empty in rare cases where the device structure is being initialized or torn down. The ifindex is always present and can be used to identify the device.

Build docs developers (and LLMs) love

Get started for freeTalk to us