1

I looking for what's causing dropped packets on an interface:

      RX packets:9064457 errors:0 dropped:4736 overruns:0 frame:0
      TX packets:6388938 errors:0 dropped:0 overruns:0 carrier:0

I know it's not the firewall because it gets dropped before it would even reach that.

I made a dumpfile with: tcpdump -n -s0 -w interface_errors.pcap -i eth1

Then I try to analyze (replay) this dump with tshark/tcpdump:

      tshark -r interface_errors.pcap not ip and not ipv6 and not arp

With this basically all I get is some LLDP Multicast, IPX packets from some windows machines. Is there any way to do further debugging to determine the root cause of these errors on the interface?

Thanks

6
  • Those drops seem more likely to me to be buffer underruns. There might be too much traffic, or a bad network driver, a shared IRQ, whatever. If I'm right you won't be able to sniff them.
    – LatinSuD
    Sep 9, 2014 at 12:18
  • Hello. I ran iptraf and the average is like 2-400kbit/s on that interface (which is gbit). I doubt it's because of too much traffic.
    – nixstack
    Sep 9, 2014 at 12:22
  • If your system is using lots of CPU, it could also drop packets because it'll hit ISR timeouts.
    – gtirloni
    Sep 9, 2014 at 12:23
  • How fast does that counter increase? Keep in mind it is a cumulative counter
    – LatinSuD
    Sep 9, 2014 at 12:24
  • Hello. The system is mostly idling, it increases slowly I just got errors of it because of the nagios monitoring system but yesterday the server was rebooted (manually) and I'm pretty sure there is something wrong with the link there.
    – nixstack
    Sep 9, 2014 at 12:37

0

You must log in to answer this question.

Browse other questions tagged .