High RX Drops Observed

[RemoteUser]

I’ve noticed a high number of RX drops on one of the interfaces.
Is it possible to reset these counters?
If so, how can I do that?

[Chris_Atkinson]

I don't recall seeing any newer guidance on this.
For a cluster you can failover then perform:

ifdown ethX; ifup ethX

[RemoteUser]

Thank you, if i do set interface off and on, it's the same right?

[Timothy_Hall]

The technique Chris posted is the only way I know how. Note that it does technically cause an outage on the interface; however, if you execute the command as a single command with a semicolon, the outage is extremely brief.  Not all RX-DRPs are loss of frames the firewall should have processed, some of them were probably "junk" frames the firewall can't process anyway.  See sk166424: Number of RX packet drops on interfaces increases on a Security Gateway R80.30 and higher ...

[Lesley]

Does HCP health check report also complain about the rx drops? are there any performance issues on the system?

What is the current value? ethtool -g eth1

[RemoteUser]

yes, hcp report complain about rx drop, yes on the system the latency it's very solw

[_Val_]

You most probably have a receiving side issue on that interface that needs to be investigated and fixed. Resetting counters will not fix it, it can only mask the issue for a period of time.

[Lesley]

Ok, share some details please. Check with cpview the errors and drops, make screenshot, check next day again. If they increase a lot share current buffer value. 

clish

set interface Lan3 rx-ringsize 1024

save config

exit

ethtool -g Lan3

# ethtool -g Lan1

Ring parameters for Lan1:

Pre-set maximums:

RX:             4096

RX Mini:        0

RX Jumbo:       0

TX:             4096

Current hardware settings:

RX:             256

RX Mini:        0

RX Jumbo:       0

TX:             1024

[RemoteUser · Accepted solution]

the issue it solved by replacing the cable, now there is not any latency 

[Timothy_Hall]

Are you sure replacing the cable solved your RX-DRPs, not RX-ERR?  A cable should not cause buffering misses (RX-DRP) unless the cable was the wrong type and linked up at a much slower speed than it should, which would actually be more likely to cause RX-OVR.  Having a hard time accepting that replacing a cable fixed just RX-DRPs.

[RemoteUser]

When the customer reported an issue with network connectivity, I checked the netstat -ni output and noticed the following:

RX-DRP: 34,137,237

RX-OK: 411,649,242

RX-ERR: Around 150, which I assume isn't significant.

and the ratio it's very high please see here:
https://community.checkpoint.com/t5/General-Topics/Ifconfig-dropped-explanation/td-p/24447

after we change the cable now seems everything works fine

[Johannes_Hoen]

Hi

Can you check the interrupts on the interfaces ? I think the box is just overloaded....

[Timothy_Hall · Accepted solution]

Diagnosing RX-DRP issues became significantly more complicated in Gaia 3.10 when the counter's meaning changed.  Here are the relevant pages from my Gateway Performance Optimization Course detailing how to assess whether or not you should do something about them: