if you have a recent enough kernel, this change https://github.com/cilium/pwru/pull/148 https://github.com/cilium/pwru/pull/148 means that it will print the rea

if you have a recent enough kernel, this change https://github.com/cilium/pwru/pull/148 https://github.com/cilium/pwru/pull/148 means that it will print the reason the packet was dropped in the output, as logged by kfree_skb_reason - see https://lwn.net/Articles/885729/ https://lwn.net/Articles/885729/ There's a whole heap of reasons a packet can be dropped: https://github.com/torvalds/linux/blob/76f598ba7d8e2bfb4855b5298caedd5af0c374a8/include/net/dropreason.h#L84 https://github.com/torvalds/linux/blob/76f598ba7d8e2bfb4855b... In any case, this makes it less painful than going back to read the kernel source. I don't think that the gif in the README is up to date with this change - it's 2 years old and this feature only appeared 2 months ago.