# Which command lists only the flows that Cilium dropped, for example because of a network policy?

Cilium, Hard (Expert), Troubleshooting. https://k8wiz.com/uquiz/which-command-lists-only-the-flows-that-cilium-dropped-for-example-because-of-a-network-policy

- A. hubble observe --verdict DENIED
- B. cilium status --drops
- C. hubble observe --verdict DROPPED
- D. kubectl get ciliumnetworkpolicies --dropped

**Answer:** hubble observe --verdict DROPPED

**Explanation:** Hubble gives every flow a verdict such as FORWARDED, DROPPED, AUDIT or REDIRECTED. There is no DENIED verdict. Filtering on DROPPED shows the dropped flows with a reason such as 'Policy denied'. Add --namespace or --pod to narrow the output to the workload you're debugging.