topic Re: MTU Packet counter increases during packet capture in General Topics

MTU Packet counter increases during packet capture

Retired Member — Sun, 18 Feb 2018 11:00:33 GMT

Doing some analysis and whilst doing a packet capture I notice that flow_fwd_mtu_exceeded starts increasing rapidly.

Any ideas?

Thanks

David

show counter global filter packet-filter yes

flow_fwd_l3_ttl_zero                   15996        0 drop      flow      forward   Packets dropped: IP TTL reaches zero
flow_fwd_l3_noarp                     879583        0 drop      flow      forward   Packets dropped: no ARP
flow_fwd_zonechange                     3213        0 drop      flow      forward   Packets dropped: forwarded to different zone
flow_fwd_mtu_exceeded                 677903     1139 info      flow      forward   Packets lengths exceeded MTU
flow_parse_unmatched_icmperr            3882        0 info      flow      parse     Packets dropped: Unmatched ICMP error message
flow_dos_pf_ipspoof                      669        0 drop      flow      dos       Packets dropped: Zone protection option 'discard-ip-spoof'

Re: MTU Packet counter increases during packet capture

reaper — Mon, 19 Feb 2018 12:03:22 GMT

the packets you're receiving are larger than the MTU on your egress interface (and likely have the DF bit set)

do both your interfaces have the same MTU set? is there a DF visible in your captures?

you may need to set TCP MSS on the egress interface to lower the mtu of your overall communication

Re: MTU Packet counter increases during packet capture

Retired Member — Wed, 21 Feb 2018 06:33:36 GMT

Thanks Reaper

I only notice this counter incrementing (quickly) when doing a Packet Capture on Palo. Normal operation I dont see this counter increase.

Thanks

David

Re: MTU Packet counter increases during packet capture

reaper — Wed, 21 Feb 2018 13:10:21 GMT

I dug a little deeper

this means your packets passing through the dataplane are actually larger, but the "mtu' for packetcapture (lives on the management plane) is 1500 so you get this message

packets are not actually discarded, just processed so the pcaps can be collected