There's a dropwatch in SystemTap which produces similar output to the dropwatch program but has been significantly more useful for our purposes. Adding a backtr

There's a dropwatch in SystemTap which produces similar output to the dropwatch program but has been significantly more useful for our purposes. Adding a backtrace to that can be useful. Beyond that we usually instrument the kernel to either printk when decisions are made, or add fields in the skb and set the fields to values as they pass through different parts of the stack, then finally things which react to those fields. That's a lot quicker and more efficient than looking at every packet.