Packet Drop Monitoring (drop_monitor and asg_drop_monitor)

Important - Starting in Take 209 of R80.20SP Jumbo Hotfix Accumulator (sk155832), the new utility "drop_monitor" replaced the previous "asg_drop_monitor" utility.

The "drop_monitor" command

Use the "drop_monitor" command in the Expert mode to monitor dropped packets on interfaces in real time.

Drop statistics arrive from these modules:

  • NICs

  • CoreXL

  • PSL

  • SecureXL

Notes:

  • This command opens a monitor session and shows aggregated data from Security Group Members.

    To stop an open session, press CTRL+C.

  • By default, this utility shows drop statistics for IPv4 traffic.

drop_monitor -h

drop_monitor [-d] [-v] [-m <SGM IDs>] [-i <List of Interfaces>] [-f <Refresh Rate>] [-sf <Query Timeout>] [-le] [-e] [-dm] [-ds] [-r] [-s] [-v6]

Parameter

Description

-h

Shows the built-in help.

-d

--debug

Runs the command in the debug mode.

-v

--verbose

Shows detailed drop statistics - for each Security Group Member and all SecureXL statistics.

-m <SGM IDs>

--members <SGM IDs>

Applies to Security Group Members as specified by the <SGM IDs>.

<SGM IDs> can be:

  • No <SGM IDs> specified, or all

    Applies to all Security Group Members and all Maestro Sites

  • One Security Group Member (for example, 1_1)

  • A comma-separated list of Security Group Members (for example, 1_1,1_4)

  • A range of Security Group Members (for example, 1_1-1_4)

  • In Dual Site, one Maestro Site (chassis1, or chassis2)

  • In Dual Site, the Active Maestro Site (chassis_active)

-i <List of Interfaces>

--interfaces <List of Interfaces>

Shows drop statistics for the specified network interfaces.

Enter the names of applicable interfaces separated a comma.

By default, this utility shows drop statistics only for the backplane interfaces.

-f <Refresh Rate>

--refresh-rate <Refresh Rate>

Specifies the output refresh rate in seconds.

The default is 3 seconds.

-sf <Query Timeout>

--ssms-refresh-rate <Query Timeout>

Specifies the query timeout in seconds.

The default is 60 seconds.

-le

--local-export

Exports drop statistics from the local Security Group Member in the JSON format.

-e

--global-export

Exports drop statistics from all Security Group Members in the JSON format.

-dm

--detailed-members

Shows drop statistics for each Security Group Member, in addition to the total drop statistics.

-ds

--detailed-securexl

Shows detailed drop statistics for SecureXL.

-r

--reset

Resets the statistics counters to 0 before it collects the data.

Note - Drop statistics are reset for CoreXL, PSL, SecureXL, and backplane interfaces.

-s

--include-ssms-stats

Shows local drop statistics only.

Only data links, management links, and downlinks are supported.

-v6

--ipv6

Shows drop statistics for IPv6 traffic.

 
[Expert@MyChassis-ch0x-0x:0]# drop_monitor
 
Dropped packets statistics of network interfaces, CoreXL, SecureXL and PSL
+----------+------------------+-------+
| Category | Statistics       | Total |
+----------+------------------+-------+
+----------+------------------+-------+
|          | RX Dropped       |   0   |
|   NIC    | TX Dropped       |   0   |
|          | Qdisc Dropped    |   0   |
+----------+------------------+-------+
|          | Outbound Dropped |   0   |
|  CoreXL  | Inbound Dropped  |   0   |
|          | F2P Dropped      |   0   |
+----------+------------------+-------+
|   PSL    | Total Dropped    |   0   |
|          | Rejected         |   0   |
+----------+------------------+-------+
| SecureXL | Total drops      |   0   |
+----------+------------------+-------+

[Expert@MyChassis-ch0x-0x:0]#
 
[Expert@MyChassis-ch0x-0x:0]# drop_monitor -v
 
Dropped packets statistics of network interfaces, CoreXL, SecureXL and PSL
+----------+----------------------+------+------+-------+
| Category | Statistics           | 1_01 | 1_02 | Total |
+----------+----------------------+------+------+-------+
+----------+----------------------+------+------+-------+
|          | RX Dropped           |  0   |  0   |   0   |
|   NIC    | TX Dropped           |  0   |  0   |   0   |
|          | Qdisc Dropped        |  0   |  0   |   0   |
+----------+----------------------+------+------+-------+
|          | Outbound Dropped     |  0   |  0   |   0   |
|  CoreXL  | Inbound Dropped      |  0   |  0   |   0   |
|          | F2P Dropped          |  0   |  0   |   0   |
+----------+----------------------+------+------+-------+
|   PSL    | Total Dropped        |  0   |  0   |   0   |
|          | Rejected             |  0   |  0   |   0   |
+----------+----------------------+------+------+-------+
|          | XMT error            |  0   |  0   |   0   |
|          | general reason       |  0   |  0   |   0   |
|          | Syn Defender         |  0   |  0   |   0   |
|          | Attack mitigation    |  0   |  0   |   0   |
|          | VPN forwarding       |  0   |  0   |   0   |
|          | corrupted packet     |  0   |  0   |   0   |
|          | hl - spoof viol      |  0   |  0   |   0   |
|          | encrypt failed       |  0   |  0   |   0   |
|          | cluster error        |  0   |  0   |   0   |
|          | anti spoofing        |  0   |  0   |   0   |
|          | monitored spoofed    |  0   |  0   |   0   |
|          | hl - new conn        |  0   |  0   |   0   |
|          | hl - TCP viol        |  0   |  0   |   0   |
|          | F2F not allowed      |  0   |  0   |   0   |
| SecureXL | fragment error       |  0   |  0   |   0   |
|          | Session rate exceed  |  0   |  0   |   0   |
|          | PXL decision         |  0   |  0   |   0   |
|          | template quota       |  0   |  0   |   0   |
|          | drop template        |  0   |  0   |   0   |
|          | sanity error         |  0   |  0   |   0   |
|          | outb - no conn       |  0   |  0   |   0   |
|          | clr pkt on vpn       |  0   |  0   |   0   |
|          | partial conn         |  0   |  0   |   0   |
|          | decrypt failed       |  0   |  0   |   0   |
|          | Connections Limit by |  0   |  0   |   0   |
|          | Source IP exceed its |  0   |  0   |   0   |
|          | local spoofing       |  0   |  0   |   0   |
|          | interface down       |  0   |  0   |   0   |
+----------+----------------------+------+------+-------+

[Expert@MyChassis-ch0x-0x:0]#

The "asg_drop_monitor" command

Use the "asg_drop_monitor" command in the Expert mode to monitor dropped packets in real time.

Drop statistics arrive from these modules:

  • NICs

  • Operating System

  • CoreXL

  • PSL

  • SecureXL

Notes:

  • This command opens a monitor session and shows aggregated data from Security Group Members.

    To stop an open session, press CTRL+C.

  • By default, this utility shows drop statistics for IPv4 traffic.

asg_drop_monitor -h

asg_drop_monitor [-r] [-6]

Parameter

Description

-h

Shows the built-in help.

-r

Resets statistics counters to 0 before it collects the data.

-ssm [-t <Timeout>]

This parameter is not supported on Maestro Security Groups (Known Limitation MBS-5478).

-6

Shows drop statistics only for IPv6 traffic.

 
[Expert@MyChassis-ch0x-0x:0]# asg_drop_monitor
 
(IPv4 Drop Statistics - All Blades)
Wed Feb 27 11:04:51 EST 2019
NICs drops (Rx):
18415
 
IP Stack qdisc drops (Tx):
0
 
CoreXL queue drops (F2F):
14781348
 
CoreXL queue drops (PXL F2P)
0
 
PSL drops(total):
0
 
PSL rejects:
0
 
Ppak drops:
Displaying aggregated data from blades: all
 
Reason                Value              Reason                Value
--------------------  ---------------    --------------------  ---------------
general reason                8881796    CPASXL decision                     0
PSLXL decision                      0    clr pkt on vpn                      0
encrypt failed                      0    drop template                       0
decrypt failed                      0    interface down                      0
cluster error                       0    XMT error                           0
anti spoofing                       0    local spoofing                      0
sanity error                        0    monitored spoofed                   0
QOS decision                        0    C2S violation                       0
S2C violation                       0    Loop prevention                     0
DOS Fragments                       0    DOS IP Options                      0
DOS Blacklists                      0    DOS Penalty Box                     0
DOS Rate Limiting                   0    Syn Attack                          0
Reorder                             0    Expired Fragments                   0
[Expert@MyChassis-ch0x-0x:0]#