topic Re: tracking bursty traffic with the firewall in General Topics

tracking bursty traffic with the firewall

Carracido — Mon, 19 Jul 2021 15:19:52 GMT

Dear community!

I´m seeing in the interfaces the "rcv_fifo_overrun" counter increasing quite a lot and I´d like to find out what´s the root cause. Is there a reliable way to verify in the firewall if the reason of this counter to increase is some bursty traffic or anything else?

Thank you!

Re: tracking bursty traffic with the firewall

BPry — Mon, 19 Jul 2021 17:06:15 GMT

@Carracido,

The rcv_fifo_overrun counters are essentially always buffer shortages due to bursty traffic. There's really not a great way to track this directly on the firewall outside of the counters.

Re: tracking bursty traffic with the firewall

OtakarKlier — Mon, 19 Jul 2021 17:17:09 GMT

Hello,

Netflow might be able to help you. If you dont have a netflow server, there are free options available. This way you'll know the endpoint causing the burst.

Regards,