1

I wrote the following short PowerShell script to help diagnose some performance issues on a server:

$counters = @("\Process(*)\% Processor Time","\Process(*)\Working Set","\Process(*)\IO Read Bytes/sec","\Process(*)\IO Write Bytes/sec","\Process(*)\IO Data Bytes/sec","\Network Interface(*)\Bytes Total/sec","\Network Interface(*)\Packets/sec","\Network Interface(*)\Packets Received Discarded","\Network Interface(*)\Packets Received Errors","\Network Interface(*)\Packets Outbound Discarded","\Network Interface(*)\Packets Outbound Errors")

$timeout = new-timespan -Seconds 10
$sw = [diagnostics.stopwatch]::StartNew()
while ($sw.elapsed -lt $timeout)
{
    get-counter -counter $counters  | select -expand countersamples | select timestamp,path,instancename,cookedvalue | export-csv -append -notypeinformation "c:\misc\counters.txt"
    start-sleep -seconds 2
}
write-host "Finished"

The script works great and gives the values I need. However, when looking at the counter for "Packets Received Discarded", it never changes from the value "801".

What is the polling period for this counter? Does it reset on reboot? I couldn't find any documentation anywhere that shows when it resets to 0.

The link from Microsoft (https://msdn.microsoft.com/en-us/library/ms803962.aspx) states:

Shows the number of inbound packets that were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol. One possible reason for discarding such a packet could be to free up buffer space.

... which still doesn't state the timeframe.

Someone else asked this on TechNet in 2015 and didn't get an answer (https://social.technet.microsoft.com/Forums/ie/en-US/f2093760-5462-45b5-a3e1-128d0b119509/packets-received-discarded?forum=winservergen).

Please help. Thanks.

1
  • 1
    I also notice that it resets to 0 when I change an adapter setting - in my case Receive-Side scaling.
    – Tim
    Dec 4, 2018 at 16:15

1 Answer 1

3

I've also been searching for clarification here and this is what I've found.

  1. There is no polling period for this counter. It is incremented as discards happen.
  2. It does reset on reboot. I have found no documentation stating this, but have seen no exceptions to this in practice.
  3. It is not reset over any time interval.
  4. When the counter reaches the max value of a DWORD (32 bit unsigned integer) it should wrap around, but some of the .NET documentation states the value will be truncated if it's greater than the max value of a 32 bit int. So, this behavior varies depending on how you access the counter.

The only reason the counter would stay at 801 is if there are no more discards. Discards should be very rare unless there is a problem. Discards generally happen during periods of very high network activity. They are more an indication of buffer issues than anything else.


SOURCES:

This is all documentation for .NET. From the same MSDN link you posted you'll see that this counter is of type PERF_COUNTER_RAWCOUNT.

Searching for more info on PERF_COUNTER_RAWCOUNT I found this comment on GitHub that states there is no time reference for these types.

            //
            //  These counters do not use any time reference
            //
            case NativeMethods.PERF_COUNTER_RAWCOUNT:
            case NativeMethods.PERF_COUNTER_RAWCOUNT_HEX:
            case NativeMethods.PERF_COUNTER_DELTA:
            case NativeMethods.PERF_COUNTER_LARGE_RAWCOUNT:
            case NativeMethods.PERF_COUNTER_LARGE_RAWCOUNT_HEX:
            case NativeMethods.PERF_COUNTER_LARGE_DELTA:
                newPdhValue.FirstValue  = newSample.RawValue;
                newPdhValue.SecondValue = 0;

This page also states there is no time reference for this counter type:

    // Indicates the data is a counter  which should not be
    // time averaged on display (such as an error counter on a serial line)
    // Display as is.  No Display Suffix.
    public const int PERF_COUNTER_RAWCOUNT =
            (PERF_SIZE_DWORD | PERF_TYPE_NUMBER | PERF_NUMBER_DECIMAL |
            PERF_DISPLAY_NO_SUFFIX);

And this comment states that any value larger than will be truncated:

    ///     Directly accesses the raw value of this counter.  If counter type is of a 32-bit size, it will truncate
    ///     the value given to 32 bits.  This can be significantly more performant for scenarios where
    ///     the raw value is sufficient.   Note that this only works for custom counters created using
    ///     this component,  non-custom counters will throw an exception if this property is accessed.

And here is the struct definition for MibIpStats which is returned by the Win32 call to get interface stats.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .