Skip to main content
The ifdump profile collects packets just after the device driver in ingress and right before the device driver in egress. This is similar to many well-known packet capture utilities that use AF_PACKET.

​
What it enables

​
Probes

The ifdump profile uses two strategic probe points:
  • tp:net:netif_receive_skb - Captures packets immediately after the device driver receives them
  • tp:net:net_dev_start_xmit - Captures packets right before they are transmitted by the device driver

​
Collectors

The profile uses the default collectors enabled by Retis, which typically include basic packet metadata.
When not using a profile and no user-defined collectors or probes are specified, retis collect uses these same probes automatically.

​
Usage

retis -p ifdump collect

​
Use cases

  • Traditional packet capture: Similar to tcpdump or wireshark
  • Interface-level monitoring: Seeing exactly what enters and leaves network interfaces
  • Driver debugging: Understanding packets at the hardware boundary
  • Baseline comparison: Creating a reference capture similar to other tools

​
Example output

The ifdump profile captures packets at the device boundary: 
7129250251406 (5) [ping] 23561 [tp] net:net_dev_start_xmit #67be86dc28effff8f67ed249b80 (skb ffff8f67919c2b00)
  if 4 (wlp82s0) [redacted] > 2606:4700:4700::1111 ttl 64 label 0xbf87b len 64 proto ICMPv6 (58) type 128 code 0

7129262331018 (0) [irq/185-iwlwifi] 1259 [tp] net:netif_receive_skb #67be926148affff8f6546b13700 (skb ffff8f6851bffd00)
  if 4 (wlp82s0) 2606:4700:4700::1111 > [redacted] ttl 54 label 0x55519 len 64 proto ICMPv6 (58) type 129 code 0
In this example:
  • The first event shows an ICMPv6 echo request (type 128) being transmitted on interface wlp82s0
  • The second event shows the corresponding echo reply (type 129) being received on the same interface
  • Both events show the raw packet at the device driver boundary

​
When to use ifdump

Choose the ifdump profile when:
  • You need packet-level visibility similar to traditional capture tools
  • You want to see packets before any kernel processing
  • You’re debugging device driver issues
  • You want minimal overhead with focused capture points

Build docs developers (and LLMs) love

Get started for freeTalk to us