- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
02-18-2018 03:00 AM
Hi
Doing some analysis and whilst doing a packet capture I notice that flow_fwd_mtu_exceeded starts increasing rapidly.
Any ideas?
Thanks
David
show counter global filter packet-filter yes
flow_fwd_l3_ttl_zero 15996 0 drop flow forward Packets dropped: IP TTL reaches zero
flow_fwd_l3_noarp 879583 0 drop flow forward Packets dropped: no ARP
flow_fwd_zonechange 3213 0 drop flow forward Packets dropped: forwarded to different zone
flow_fwd_mtu_exceeded 677903 1139 info flow forward Packets lengths exceeded MTU
flow_parse_unmatched_icmperr 3882 0 info flow parse Packets dropped: Unmatched ICMP error message
flow_dos_pf_ipspoof 669 0 drop flow dos Packets dropped: Zone protection option 'discard-ip-spoof'
02-19-2018 04:03 AM
the packets you're receiving are larger than the MTU on your egress interface (and likely have the DF bit set)
do both your interfaces have the same MTU set? is there a DF visible in your captures?
you may need to set TCP MSS on the egress interface to lower the mtu of your overall communication
02-20-2018 10:33 PM
Thanks Reaper
I only notice this counter incrementing (quickly) when doing a Packet Capture on Palo. Normal operation I dont see this counter increase.
Thanks
David
02-21-2018 05:10 AM
I dug a little deeper
this means your packets passing through the dataplane are actually larger, but the "mtu' for packetcapture (lives on the management plane) is 1500 so you get this message
packets are not actually discarded, just processed so the pcaps can be collected
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!