Linux – Analysing incoming TCP packet discards on GNU/Linux

linuxnetworkingpacketloss

I use Ubntu 12.04 Server as a gateway/router. The server has two NetXtreme BCM5721 Gigabit Ethernet PCI Express cards for LAN and WAN interfaces. Opennms monitoring software shows incoming packet discards on the WAN (ISP) interface. The ISP provides direct Ethernet connectivity via SDH/SONET ring. However I don't see any packet discard on the LAN interface. Here is the WAN interface graph:

enter image description here

Are there any tools/commands to discover what is responsible for such packet discards. Is it possible to know if some misconfiguration at ISP's side is causing such an issue.

Ifconfig Output:

eth1      Link encap:Ethernet  HWaddr **:**:**:**:63:5d  
          inet addr:***.***.4.130  Bcast:***.***.4.131  Mask:255.255.255.252
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:865089489 errors:0 dropped:596 overruns:0 frame:3
          TX packets:498072410 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1092458492329 (1.0 TB)  TX bytes:48179244881 (48.1 GB)
          Interrupt:17

Best Answer

The ethtool command is used to query the driver for statistics that the NIC is reporting. ethtool -S ethX will show you the stats for a particular card, and you can see where the drops are.

Most commonly you'll be losing packets in the ring buffer (reported as a stat like "discard" "fifo" "bufs", it varies from card to card) and you resolve this by increasing the ring buffer with ethtool -g. See man ethtool for more.

The netstat command is used to query the kernel's networking stack. netstat -s will show you statistics and you can see if you're losing traffic in the backlog (after NIC but before socket buffer) or in socket buffers (too-small buffers or slow application) or elsewhere.

Related Topic