In one embodiment, a method includes determining that a packet has been dropped for a flow of packets between a source and destination. This may be determined at a network device that is forwarding the packets. Information related to a possible cause for the packet being dropped is then determined. For example, a context as to why the packet is dropped may be determined. The context is then associated with information for the flow and is useful to perform a packet drop analysis for the flow. For example, a source and destination for the flow is recorded along with the possible cause of the packet drop. This information may be stored and sent to an aggregation device. The aggregation device may then analyze the entry, possibly along with other entries from this network device or other network devices, and determine any troubleshooting information for the packet drops.