---
name: "dwdump"
section: "1"
platform: "linux"
package: "dropwatch"
version: "1.5.4-4"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/dwdump"
---

# dwdump(1)

dump kernel dropped packets to a file

## NAME

dwdump - dump kernel dropped packets to a file

## SYNOPSIS

**dwdump** \[ *OPTIONS* \]

## OPTIONS

- **-w**, **--write** *FILE*

  Dump packets to provided file in pcap format. Defaults to standard output.

- **-t**, **--trunc** *LENGTH*

  Ask the kernel to truncate packets to provided length. Defaults to no truncation.

- **-q**, **--query**

  Query the kernel for current configuration and exit.

- **-l**, **--limit** *LIMIT*

  Ask the kernel to set the per-CPU packet queue limit to provided limit. Defaults to 1,000 packets.

- **-p**, **--passive**

  Only listen on notified packets with no configuration. This is useful if the kernel is already monitoring dropped packets and you only want to open another listening socket.

- **-s**, **--stats**

  Query the kernel for statistics and exit.

- **-b**, **--bufsize** *SIZE*

  Set the socket's receive buffer to provided size. Defaults to 1MB.

- **-o**, **--origin** { **sw** \| **hw** }

  Ask the kernel to only monitor software or hardware originated drops. Defaults to both. See [**devlink-trap**(8)](/devlink-trap/8.md) for details on how to get hardware originated drops to the kernel.

- **-e**, **--exit**

  Ask the kernel to stop monitoring and exit.

## EXAMPLES

dwdump -w drops.pcap

Dump dropped packets to a file.

dwdump \| tshark -V -r -

Pipe dropped packets to Wireshark.

dwdump -o sw -w drops.pcap

Only monitor software originated drops.

dwdump -q

Query current configuration from the kernel and exit.

## SEE ALSO

[**dropwatch**(1)](/dropwatch/1.md), [**devlink-trap**(8)](/devlink-trap/8.md), [**tshark**(1)](/tshark/1.md),\