Awesome Open Source
Awesome Open Source


Trace a ping packet on the L2 layer, as it crosses Linux network interfaces and namespaces. Supports IPv4 and IPv6.

> modprobe ip_tables ip6_tables
> sudo python
    NETWORK NS        INTERFACE    TYPE ADDRESSES                          IPTABLES
[           0]                  request ->               nat.OUTPUT      :ACCEPT
[           0]                  request ->            filter.OUTPUT      :ACCEPT
[  4026531992]          docker0 request ->               nat.POSTROUTING :ACCEPT
[  4026531992]          docker0 request ->          
[  4026531992]      veth61528aa request ->          
[  4026533448]             eth0 request ->          
[  4026533448]             eth0   reply ->          
[  4026531992]      veth61528aa   reply ->          
[  4026531992]          docker0   reply ->          
[  4026531992]          docker0   reply ->            filter.INPUT       :ACCEPT

The first 2 packets going from the current network namespace to a Docker container and going back, crossing a veth pair and a bridge.


  • Record crossed Linux network interfaces
  • Record crossed Linux network namespaces
  • Record crossed iptables chains

Note: The iptables tracing support is experimental. Tracing which specific rule matches within a chain is not supported. This would require to hook into trace_packet netfilter function which is unfortunatly static and therefore private.

The full story

This project started as an illustration for a blog post on perf and eBPF


To use this project, you need a working / recent BCC install on your system. Read more about BCC on their Github repository:

Additionally, you'll need a recent kernel (presumably >= 4.7) and full root privilege.



Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
c (15,721
networking (423
tracing (126
ebpf (37