Skip to main content
The skb drop section captures why packets are dropped by the Linux kernel, including the subsystem and specific drop reason.

​
Fields

​
subsys
string
Subsystem that dropped the packet.Examples: "core", "ovs", "openvswitch"When null, the drop reason comes from the core networking stack.
​
drop_reason
string
required
The specific reason the packet was dropped.This corresponds to values in the kernel’s enum skb_drop_reason and subsystem-specific drop reasons.

​
Drop Reasons

​
Core Drop Reasons

When subsys is null, these are standard kernel drop reasons from enum skb_drop_reason:
  • NOT_SPECIFIED - Drop reason not specified
  • NO_SOCKET - No socket found for packet
  • PKT_TOO_SMALL - Packet too small
  • TCP_CSUM - TCP checksum error
  • UDP_CSUM - UDP checksum error
  • IP_CSUM - IP checksum error
  • UNICAST_IN_L2_MULTICAST - Unicast packet in L2 multicast
  • XFRM_POLICY - Dropped by XFRM policy
  • IP_NOPROTO - No protocol handler
  • SOCKET_BACKLOG - Socket backlog full
  • NETFILTER_DROP - Dropped by Netfilter
  • OTHERHOST - Packet for another host
  • IP_LOCALOUT - Error in ip_local_out
  • TCP_OLD_DATA - TCP old data
  • TCP_ACK_UNSENT_DATA - TCP ACK for unsent data
  • TCP_FLAGS - Invalid TCP flags
  • TCP_ZEROWINDOW - TCP zero window
  • TCP_OLD_ACK - Old TCP ACK
  • TCP_TOO_OLD_ACK - TCP ACK too old
  • TCP_ACK_UNSENT - TCP ACK for unsent data
  • TCP_INVALID_SEQUENCE - Invalid TCP sequence
  • TCP_RESET - TCP reset
  • TCP_INVALID_SYN - Invalid TCP SYN
  • TCP_CLOSE - TCP connection closed
  • TCP_FASTOPEN - TCP FastOpen error
  • TCP_OLD_SEQUENCE - Old TCP sequence
  • TCP_KEEPALIVE - TCP keepalive
  • TCP_EMBRYONIC_RST - RST on embryonic connection
  • TCP_ABORT_ON_DATA - Abort with data pending

​
Subsystem Drop Reasons

When subsys is set, drop reasons are specific to that subsystem. For example, OpenvSwitch has reasons like:
  • FLOW_ACTION - Explicit drop action in flow
  • RECURSION_LIMIT - Recursion limit exceeded
  • DEFERRED_LIMIT - Too many deferred actions
  • FRAG_L2_TOO_LONG - Layer 2 fragment too long
  • FRAG_INVALID_PROTO - Invalid fragmentation protocol

​
Display Format

The drop section is displayed as: Core drop: 
drop (reason {reason})
Subsystem drop: 
drop (reason {subsys}/{reason})

​
Examples

drop (reason NOT_SPECIFIED)
drop (reason TCP_INVALID_SEQUENCE)
drop (reason ovs/FLOW_ACTION)
drop (reason openvswitch/RECURSION_LIMIT)

​
Example JSON

​
Core Drop

{
  "skb_drop": {
    "subsys": null,
    "drop_reason": "TCP_INVALID_SEQUENCE"
  }
}

​
Subsystem Drop (OpenvSwitch)

{
  "skb_drop": {
    "subsys": "ovs",
    "drop_reason": "FLOW_ACTION"
  }
}

​
Drop with No Reason

{
  "skb_drop": {
    "subsys": null,
    "drop_reason": "NOT_SPECIFIED"
  }
}

​
Complete Event Example

Drop event with full context: 
{
  "common": {
    "timestamp": 7322460997041,
    "smp_id": 0,
    "task": {
      "pid": 0,
      "tgid": 0,
      "comm": "swapper/0"
    }
  },
  "kernel": {
    "symbol": "kfree_skb_reason",
    "probe_type": "kprobe"
  },
  "skb_tracking": {
    "orig_head": 18446623346735780864,
    "timestamp": 7322460997041,
    "skb": 18446623349161350912
  },
  "skb_drop": {
    "subsys": null,
    "drop_reason": "TCP_INVALID_SEQUENCE"
  },
  "packet": {
    "len": 60,
    "capture_len": 60,
    "data": "...(base64)..."
  }
}

​
When This Section Appears

The skb drop section is populated when:
  • The skb-drop collector is enabled (-c skb-drop)
  • The probe fires at a drop location (e.g., kfree_skb_reason)
  • The kernel provides drop reason information

​
Analyzing Drops

Use drop information to:
  1. Identify drop patterns: Group by drop_reason to find common issues
  2. Filter by subsystem: Focus on specific subsystems like ovs
  3. Correlate with packet data: Use packet section to see what was dropped
  4. Track drop locations: Use kernel.symbol to see where drops occur
  5. Follow flows: Combine with skb_tracking to see packet journey before drop

​
Example Analysis

# Filter to see only TCP-related drops
retis print events.json | grep "TCP_"

# Count drop reasons
retis print events.json --format json | \
  jq -r '.events[].skb_drop.drop_reason' | sort | uniq -c

# Find all OpenvSwitch drops  
retis print events.json --format json | \
  jq '.events[] | select(.skb_drop.subsys == "ovs")'
Drop reasons require kernel support for the drop monitor subsystem. Older kernels may only report NOT_SPECIFIED. For best results, use kernel 5.17 or later.

Build docs developers (and LLMs) love

Get started for freeTalk to us