Follow

Troubleshooting interface and Ethernet errors

Cognito Detect Sensor appliances, or Cognito Detect Brain appliances in mixed mode, present several CLI commands to assist administrators investigating Ethernet issues.  This article documents the 'show traffic stats' command.

show traffic stats

Example output:

vscli > show traffic stats
Eth5:
    Packets Missed: 1260,
    Packet Errors: 0,
    Packets Dropped: 0,
    Packets Received: 498327319,
    Interface Up: True
Eth4:
    Packets Missed: 7325,
    Packet Errors: 0,
    Packets Dropped: 0,
    Packets Received: 22384035202,
    Interface Up: True
Eth3:
    Packets Missed: 0,
    Packet Errors: 0,
    Packets Dropped: 0,
    Packets Received: 609766204,
    Interface Up: True
Eth2:
    Packets Missed: 0,
    Packet Errors: 0,
    Packets Dropped: 0,
    Packets Received: 0,
    Interface Up: True
Eth1:
    Packets Missed: 0,
    Packet Errors: 0,
    Packets Dropped: 0,
    Packets Received: 0,
    Interface Up: False
Eth0:
    Packets Missed: 0,
    Packet Errors: 0,
    Packets Dropped: 0,
    Packets Received: 0,
    Interface Up: False

Each interface listed presents the following statistics:

Packets Missed

The count of received packets missed due to lack of memory buffers.  Sensors showing high or rolling counts should be investigated for over-subscription or bursty traffic.  Sub-second packet bursts may temporarily oversubscribe the appliance without appearing on traffic graphs.

Packet Errors

The count of received packets arriving with CRC errors.  These packets are likely to be corrupted en route to the capture port and is likely to be the direct result of a physical fault in the link between the switch and sensor.

In most cases swapping the switch port, sensor port, SFPs and fiber/Ethernet cables in a trial-and-error diagnosis is the quickest way to resolve this issue.

Should the link between the switch and the sensor be clean and without fault the switch should be investigated further as packets with errors arriving at a cut-through switch will be forwarded directly out of the egress ports.

Packets Dropped

The count of packets dropped due to memory buffer allocation failures.  Sensors showing high or rolling counts should be investigated for oversubscription or bursty traffic.  Subsecond packet bursts may temporarily oversubscribe the appliance without appearing on traffic graphs.

Packets Received

The total count of packets received since the last restart (usually due to reboot or update).

Interface Up

Whether the appliance currently sees the interface as 'up'.

Was this article helpful?
0 out of 0 found this helpful

Download PDF

0 Comments

Article is closed for comments.