topic Re: Decrypt monitor interface errors in General Topics

Decrypt monitor interface errors

dehaasm — Thu, 23 Mar 2023 15:12:39 GMT

We have SSL decryption enabled and are sending the traffic to monitor interface (private) to analyze at a SOC.

In the messages log files I see around 30k errors last week which might be some kind of bug, could someone please confirm this?

the error in messges is:

kernel [ERROR]: dat_module_send_error_log: Decrypt and Forward type - Mirror only , recorer_name -eth6, nic_name - eth6, reason - Failed to send packet

Should we invetigate via CP TAC case?

Re: Decrypt monitor interface errors

PhoneBoy — Mon, 27 Mar 2023 16:43:23 GMT

When "mirroring" traffic out an interface, there is always the risk that you may overrun the mirror interface.
Especially if traffic from multiple interfaces is being mirrored out a specific port.
This should show in the interface statistics: have you checked (should be similar to show interface eth6 in clish).

Re: Decrypt monitor interface errors

dehaasm — Wed, 29 Mar 2023 11:26:23 GMT

I only see this no errors should I open TAC case what do you think?

Statistics:
TX bytes:232380297797309 packets:229616496289 errors:0 dropped:0 overruns:0 carrier:0
RX bytes:4709248 packets:73582 errors:0 dropped:0 overruns:0 frame:0

Re: Decrypt monitor interface errors

PhoneBoy — Wed, 29 Mar 2023 17:27:57 GMT

A TAC case is probably in order just to rule out any issues.