topic show counter global filter delta yes -----drops in General Topics

show counter global filter delta yes -----drops

MP18 — Sat, 03 Nov 2018 04:51:06 GMT

when i run command

show counter global filter delta yes

i see below counters incrementing need to understand which are these drops and why PA is dropping these packets?

do they impact the performance of the PA?

flow_tcp_non_syn_drop

flow_fpga_egress_exception_err

flow_fwd_l3_ttl_zero

flow_action_close

Raido_Rattameister — Sat, 03 Nov 2018 05:31:12 GMT

Those names are pretty self explaining.

Also description field helps to explain.

For example description for flow_tcp_non_syn_drop says:

Packets dropped: non-SYN TCP without session match

It means that if the first packet in a session is a TCP packet and it does not have the SYN bit set, the firewall discards it (default).

It might help you to get familiar how Palo processes packet.

MP18 — Sat, 03 Nov 2018 14:01:37 GMT

can you please explain about this

flow_fpga_egress_exception_err