topic Re: Capture shows packet drops by kernel in Firewall and Security Management

Capture shows packet drops by kernel

Gaurav_Pandya — Wed, 13 Apr 2022 18:36:14 GMT

Hi Mates,

We have syslog traffic passing through firewall. It is Tons of traffic. Syslog admin was saying that he is not getting enough data from all devices.

When I captured tcpdump traffic on firewall, it shows only 7 to 8 packets but at the end it shows,

9 packets captured

2633 packets received by filter

2448 packets dropped by kernel

I am not seeing any drops with fw ctl zdebug command. Sometime capture says "buffer full". We dont want to increase buffer size. Is there any suggestion how we can resolve this (dropped by kernel) issue?

There is no issue with route or flow. syslog receives data but it is not enough,

Re: Capture shows packet drops by kernel

Timothy_Hall — Wed, 13 Apr 2022 20:28:29 GMT

The "packets dropped by kernel" just means that captured packets streamed into tcpdump's buffer faster than they could be emptied and were lost for purposes of being captured. You did not actually lose any traffic being processed by the firewall as traffic is copied (or "T"'ed) at the NIC driver level into tcpdump's buffer, and the original packet continues on and is not lost.

I believe the default size of tcpdump's buffer is 32767 KiB (32MB), you could try increasing it via the -B option to something like 65536 and see if that eliminates the kernel drops. Or try to apply a more stringent filter in your tcpdump syntax.

Or best of all just use cppcap instead.

Re: Capture shows packet drops by kernel

Gaurav_Pandya — Thu, 14 Apr 2022 09:39:22 GMT

Hi Tim,

Thanks for the explanation. Actually I was confused because I was not able to capture any packet with fw monitor as well but as it is R80.30 version, I need to use "fw monitor -F" syntax to capture traffic. Now all is set.

Thanks.

Re: Capture shows packet drops by kernel

Timothy_Hall — Thu, 14 Apr 2022 11:50:08 GMT

Yes if you can live with fw monitor -F's extremely limited filtering syntax that will work too.