topic Drops in packet capture in General Topics

Drops in packet capture

Jafar_Hussain — Thu, 21 May 2020 07:02:29 GMT

Hello Team,

I have a question regarding drops during the packet capture.

What is the packet drop means - Firewall dropping any packet or firewall detect drops packet.?

Once i performed the packet capture at the same time i have run the command global counter but i didn't get any drop in counter.

So could you please let me know what is the meaning of this.

Regards,

Jafar Hussain

Re: Drops in packet capture

reaper — Sat, 23 May 2020 06:26:44 GMT

The drop stage captures packets that the firewall discards

This could be through policy action, threat detection, or packet malformation

Re: Drops in packet capture

Jafar_Hussain — Sat, 23 May 2020 06:50:23 GMT

@reaper

Thank you for your reply.

I have configured a VPN tunnel Site A and site B.My client is in site A and the server belongs from Site B.

- In the security policy allowed traffic any with specific IP addresses b/w client and server.

- Once i copied any big file from Server to client i am getting drops packet in a packet capture.

- I have checked the files are copied through NBSS and SMB2 protocol.

- When i checked the drops packet in Wireshark, i can see multiple packets TCP retransmissions from server-side and 2 packets also from server side with error: - Notify Response, Error: STATUS_NOTIFY_CLEANUP.

- My concern is why the firewall is drop packets.

Note: - Files are copied successfully but it takes a too long time.

Please suggest.

Re: Drops in packet capture

reaper — Sat, 23 May 2020 06:57:40 GMT

Global counters should help with this

It sounds like there may be packets sent out of order or out of window that the firewall is discarding

Re: Drops in packet capture

Jafar_Hussain — Sat, 23 May 2020 07:01:29 GMT

@reaperThanks you for your quick response.

While packet capture I have run the global counter but I didn't get any drops.

What steps i need to do for fix this issue. is this a firewall issue?

Re: Drops in packet capture

reaper — Sat, 23 May 2020 07:11:04 GMT

@Jafar_Hussainwhich counters did you see?

It sounds like a network issue you may be able to workaround by relaxing the firewalls tolerance if you are unable to address the network latency

Re: Drops in packet capture

Jafar_Hussain — Sat, 23 May 2020 07:46:14 GMT

@reaper

I have seen show counter global filter packet-filter yes delta yes.

but didn't get any drops.

I am not getting this point workaround by relaxing the firewalls tolerance could you please brief.

Re: Drops in packet capture

reaper — Sat, 23 May 2020 09:40:58 GMT

@Jafar_Hussain there are several settings that can be set to be less strict (timers, out of window/order packets,...) So network problems are allowed to happen rather than prevented. We'll need to find the global counters you do see to properly advise what to try. Please share the global counters seen

Re: Drops in packet capture

Jafar_Hussain — Sat, 23 May 2020 10:22:08 GMT

@reaper

Below is the result of counter command:-

I want to know only is there any issue with the firewall setting? because i have allowed all traffic b/w client and server.

or the traffic is going via a tunnel it may be cause this issue?

Re: Drops in packet capture

reaper — Sat, 23 May 2020 10:24:44 GMT

Please post the global counters without the drop filter

Re: Drops in packet capture

Jafar_Hussain — Sat, 23 May 2020 10:45:47 GMT

@reaper

Oh, i took the capture with drop filter. now it is very tough to access of firewall again.

I will share the counter once i will take access again, apart from this. is there any suggestion from your side?

Re: Drops in packet capture

Jafar_Hussain — Sat, 30 May 2020 09:25:55 GMT

@reaper

I am facing this issue with LAN also. traffic is flowing trust zone to DMZ zone internally inside the firewall.

When i check this, the same issue is happening meantime I run the counter and found a firewall drop some packets. below is the snapshot.

please suggest this.

Thanks in advance.

Re: Drops in packet capture

reaper — Sat, 30 May 2020 09:47:42 GMT

The content engine queue is getting full

This could be due to too many small/large packets or other issues (fragmentation,...), but you used the drop filter again so there's not enough information to make an educated guess

Please try

> Debug dataplane pool statistics

Re: Drops in packet capture

Jafar_Hussain — Sat, 30 May 2020 11:14:48 GMT

@reaper

Thanks for the reply.

I will try with command.

Re: Drops in packet capture

Jafar_Hussain — Sat, 30 May 2020 12:25:18 GMT

@reaper

Below is the output of the command:- show counter global filter packet-filter yes delta yes

Debug command output I will share later.