Inspect and Dump a Devlink Dpipe Pipeline Safely

Packets are being forwarded the wrong way and the switch ASIC is not telling you why. devlink dpipe lets you inspect the device's dataplane pipeline, dump a table, and enable or disable table counters where the driver supports them. It takes about fifteen minutes, and the examples describe iproute2 6.1.0, the version installed here.

• You need: a shell, the iproute2 package, and a devlink device whose driver implements dpipe.
• Device-specific output: the hardware driver supplies dpipe output, so names and fields differ between devices.
• Read-only except one step: the inspection commands change nothing. The table set example changes device state, may need elevated privileges, and can affect resource use.

1. Check the installed command

Start with ordinary, read-only checks. They need no sudo:

$ command -v devlink
/usr/sbin/devlink
$ devlink -V
devlink utility, iproute2-6.1.0
$ devlink dpipe help
Usage: devlink dpipe table show DEV [ name TABLE_NAME ]
       devlink dpipe table set DEV name TABLE_NAME
                               [ counters_enabled { true | false } ]
       devlink dpipe table dump DEV name TABLE_NAME
       devlink dpipe header show DEV

The help output tells you the four dpipe operations: show table attributes, set table attributes, dump table entries and show pipeline headers. The device argument is a devlink device identifier, which is not always an ordinary network interface name.

2. Find the devlink device identifier

List the devices before substituting one into a dpipe command:

$ devlink dev show

On a host with a suitable driver, this prints identifiers such as pci/0000:01:00.0. If it prints nothing, stop: there is no device here and this workflow cannot produce table output. Do not invent a PCI address from a diagram or copy one from another machine.

Set a shell variable only after checking the list. Replace the value below with an identifier that actually appeared in your output:

DEV='pci/0000:01:00.0'

3. Show the pipeline headers

Ask the driver for the headers that describe its dataplane pipeline:

$ devlink dpipe header show "$DEV"

The output is driver-specific. It may include the header names and fields used by the tables. Treat it as a description of this device's current dpipe model, not a portable schema for another switch. The installed manual calls this operation header show; it takes the device but no table name.

If the command says the kernel does not support the operation, check the driver and kernel version before trying other syntax. Dpipe cannot add dpipe support to a driver.

4. List the tables and inspect one

List every dpipe table the device exposes:

$ devlink dpipe table show "$DEV"

Record one table name from that output. In the manual's example it is mlxsw_erif, but that name is not a default and will not exist on unrelated hardware. Put the real name in a variable:

TABLE='TABLE_NAME_FROM_DEVLINK_OUTPUT'

Now request just that table:

$ devlink dpipe table show "$DEV" name "$TABLE"

This is where the useful attributes normally appear, including the table's match fields and whether counters are enabled. Formatting and values belong to the driver. If the table name is rejected, copy it again from the unfiltered listing; a similar name is not an alias.

5. Dump the table entries

Once you have identified the table, dump its entries:

$ devlink dpipe table dump "$DEV" name "$TABLE"

The result is hardware state, not a fixed text format. Save it for comparison if you are investigating forwarding behaviour:

$ devlink dpipe table dump "$DEV" name "$TABLE" > "${TABLE}.dpipe.txt"
$ test -s "${TABLE}.dpipe.txt" && printf '%s\n' 'dpipe dump captured'

6. Change counters only when you mean to

The manual exposes one table attribute: counters_enabled. Enabling it may consume hardware resources or change what later dumps report. This changes state, so take a capture first and check the maintenance procedure for the device:

$ sudo devlink dpipe table set "$DEV" name "$TABLE" counters_enabled true

Use elevated privileges only if the device policy requires them; if the unprivileged command is allowed, omit sudo. A successful command is normally quiet, so verify by showing the table again:

$ devlink dpipe table show "$DEV" name "$TABLE"

$ sudo devlink dpipe table set "$DEV" name "$TABLE" counters_enabled false
$ devlink dpipe table show "$DEV" name "$TABLE"

If the driver rejects the attribute, leave the device unchanged and check its documentation for counter support. Do not toggle the setting repeatedly as a diagnostic shortcut.

7. Separate syntax errors from device failures

Keep the shape of each operation in mind:

• Listing: devlink dpipe table show DEV lists tables, while adding name TABLE_NAME selects one.
• Dumping: devlink dpipe table dump DEV name TABLE_NAME reads entries; it does not enable counters.
• Headers: devlink dpipe header show DEV shows headers and does not select a table.
• Changing: devlink dpipe table set DEV name TABLE_NAME counters_enabled true|false changes an attribute and counts as privileged device administration.

For a failing command, rerun the read-only device and table listings first. Confirm the device is present, the driver exposes dpipe, and the table name is exact. On this installation, querying a deliberately absent device returns a kernel No such device error and a non-zero status. That points at the identifier or the hardware, not a missing shell option.