Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Gaurav_Pandya
Advisor

Capture shows packet drops by kernel

Hi Mates,

We have syslog traffic passing through firewall. It is Tons of traffic. Syslog admin was saying that he is not getting enough data from all devices. 

When I captured tcpdump traffic on firewall, it shows only 7 to 8 packets but at the end it shows,

9 packets captured

2633 packets received by filter

2448 packets dropped by kernel

 

I am not seeing any drops with fw ctl zdebug command. Sometime capture says "buffer full". We dont want to increase buffer size. Is there any suggestion how we can resolve this (dropped by kernel) issue?

There is no issue with route or flow. syslog receives data but it is not enough,  

0 Kudos
3 Replies
Timothy_Hall
Legend Legend
Legend

The "packets dropped by kernel" just means that captured packets streamed into tcpdump's buffer faster than they could be emptied and were lost for purposes of being captured.  You did not actually lose any traffic being processed by the firewall as traffic is copied (or "T"'ed) at the NIC driver level into tcpdump's buffer, and the original packet continues on and is not lost.

I believe the default size of tcpdump's buffer is 32767 KiB (32MB), you could try increasing it via the -B option to something like 65536 and see if that eliminates the kernel drops.  Or try to apply a more stringent filter in your tcpdump syntax.

Or best of all just use cppcap instead.

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
Gaurav_Pandya
Advisor

Hi Tim,

Thanks for the explanation. Actually I was confused because I was not able to capture any packet with fw monitor as well but as it is R80.30 version, I need to use "fw monitor -F" syntax to capture traffic. Now all is set.

Thanks.

0 Kudos
Timothy_Hall
Legend Legend
Legend

Yes if you can live with fw monitor -F's extremely limited filtering syntax that will work too.

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events