Using tcpdump to identify dropped packets
Clash Royale CLAN TAG#URR8PPP
up vote
0
down vote
favorite
I have three Fedora systems (one is a VM) connected to a cable modem and all three are showing dropped packets on the interface connected to the cable modem:
br0: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST> mtu 1500
inet 68.195.191.45 netmask 255.255.255.248 broadcast 68.195.191.47
inet6 ::16da:e9ff:fe97:ab71 prefixlen 64 scopeid 0x0<global>
inet6 fe80::16da:e9ff:fe97:ab71 prefixlen 64 scopeid 0x20<link>
ether 14:da:e9:97:ab:71 txqueuelen 1000 (Ethernet)
RX packets 343974520 bytes 362346759020 (337.4 GiB)
RX errors 0 dropped 1756203 overruns 0 frame 0
TX packets 379863195 bytes 161443693923 (150.3 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
My cable provider (cablevision/optonline/altice) reports there are no issues on their side. They've replaced their modem and even the line from the street. I really don't believe it's a cabling problem.
The bridge was created to support virtual machines. Here is the Ethernet interface directly attached to the modem:
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::ec4:7aff:fea9:18de prefixlen 64 scopeid 0x20<link>
ether 0c:c4:7a:a9:18:de txqueuelen 1000 (Ethernet)
RX packets 1049104943 bytes 1119862100182 (1.0 TiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 744768695 bytes 426022225424 (396.7 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device memory 0xfb120000-fb13ffff
First, what could explain dropped packets on any computer connected to this cable modem? I also don't believe it's a utilization issue.
Questions
- How can I use tcpdump to identify which packets are being dropped, and the reason why they are dropped?
- How can I tell if the system doesn't have enough kernel resources to keep all the received packets?
I've identified some packets which were dropped according to
netstat. Is this something I should troubleshoot further?# netstat -s|grep -Ei 'drop|fail'
933 outgoing packets dropped
72 dropped because of missing route
1 fragments dropped after timeout
1 packet reassemblies failed
219791 input ICMP message failed
0 ICMP messages failed
54122 failed connection attempts
2112 ICMP packets dropped because they were out-of-window
329 SYNs to LISTEN sockets dropped
TCPSackFailures: 250
TCPSackRecoveryFail: 232
TCPDeferAcceptDrop: 103900
linux networking fedora tcpdump netstat
edited Jul 12 at 2:47
slm♦
233k65479651
asked Jul 11 at 14:16
Alex Regan
11
 |Â
show 1 more comment
up vote
0
down vote
favorite
I have three Fedora systems (one is a VM) connected to a cable modem and all three are showing dropped packets on the interface connected to the cable modem:
br0: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST> mtu 1500
inet 68.195.191.45 netmask 255.255.255.248 broadcast 68.195.191.47
inet6 ::16da:e9ff:fe97:ab71 prefixlen 64 scopeid 0x0<global>
inet6 fe80::16da:e9ff:fe97:ab71 prefixlen 64 scopeid 0x20<link>
ether 14:da:e9:97:ab:71 txqueuelen 1000 (Ethernet)
RX packets 343974520 bytes 362346759020 (337.4 GiB)
RX errors 0 dropped 1756203 overruns 0 frame 0
TX packets 379863195 bytes 161443693923 (150.3 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
My cable provider (cablevision/optonline/altice) reports there are no issues on their side. They've replaced their modem and even the line from the street. I really don't believe it's a cabling problem.
The bridge was created to support virtual machines. Here is the Ethernet interface directly attached to the modem:
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::ec4:7aff:fea9:18de prefixlen 64 scopeid 0x20<link>
ether 0c:c4:7a:a9:18:de txqueuelen 1000 (Ethernet)
RX packets 1049104943 bytes 1119862100182 (1.0 TiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 744768695 bytes 426022225424 (396.7 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device memory 0xfb120000-fb13ffff
First, what could explain dropped packets on any computer connected to this cable modem? I also don't believe it's a utilization issue.
Questions
- How can I use tcpdump to identify which packets are being dropped, and the reason why they are dropped?
- How can I tell if the system doesn't have enough kernel resources to keep all the received packets?
I've identified some packets which were dropped according to
netstat. Is this something I should troubleshoot further?# netstat -s|grep -Ei 'drop|fail'
933 outgoing packets dropped
72 dropped because of missing route
1 fragments dropped after timeout
1 packet reassemblies failed
219791 input ICMP message failed
0 ICMP messages failed
54122 failed connection attempts
2112 ICMP packets dropped because they were out-of-window
329 SYNs to LISTEN sockets dropped
TCPSackFailures: 250
TCPSackRecoveryFail: 232
TCPDeferAcceptDrop: 103900
linux networking fedora tcpdump netstat
edited Jul 12 at 2:47
slm♦
233k65479651
asked Jul 11 at 14:16
Alex Regan
11
Your interface name,br0suggests that that's a bridge, not the actual link to the cable modem.
– Andy Dalton
Jul 11 at 14:39
Isn't it possibly congestion on your machine? You don't have enough kernel resources to keep all the received packets. Eg are you trying to receive multicast packets or udp streams with no flow control?
– meuh
Jul 11 at 14:54
I've added the eth0 info and a question about kernel resources. How can I tell if a limit is being reached?
– Alex Regan
Jul 11 at 15:53
check out this suse support answer.ethtoolandnetstat -smay give insight. Read redhat's chapters on networking.
– meuh
Jul 11 at 17:04
thanks, I forgot about that. I've added what I believe is the relevant netstat output. Do I need to investigate further? There are apparently a lot of ICMP dropped packets...
– Alex Regan
Jul 12 at 0:01
 |Â
show 1 more comment
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I have three Fedora systems (one is a VM) connected to a cable modem and all three are showing dropped packets on the interface connected to the cable modem:
br0: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST> mtu 1500
inet 68.195.191.45 netmask 255.255.255.248 broadcast 68.195.191.47
inet6 ::16da:e9ff:fe97:ab71 prefixlen 64 scopeid 0x0<global>
inet6 fe80::16da:e9ff:fe97:ab71 prefixlen 64 scopeid 0x20<link>
ether 14:da:e9:97:ab:71 txqueuelen 1000 (Ethernet)
RX packets 343974520 bytes 362346759020 (337.4 GiB)
RX errors 0 dropped 1756203 overruns 0 frame 0
TX packets 379863195 bytes 161443693923 (150.3 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
My cable provider (cablevision/optonline/altice) reports there are no issues on their side. They've replaced their modem and even the line from the street. I really don't believe it's a cabling problem.
The bridge was created to support virtual machines. Here is the Ethernet interface directly attached to the modem:
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::ec4:7aff:fea9:18de prefixlen 64 scopeid 0x20<link>
ether 0c:c4:7a:a9:18:de txqueuelen 1000 (Ethernet)
RX packets 1049104943 bytes 1119862100182 (1.0 TiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 744768695 bytes 426022225424 (396.7 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device memory 0xfb120000-fb13ffff
First, what could explain dropped packets on any computer connected to this cable modem? I also don't believe it's a utilization issue.
Questions
- How can I use tcpdump to identify which packets are being dropped, and the reason why they are dropped?
- How can I tell if the system doesn't have enough kernel resources to keep all the received packets?
I've identified some packets which were dropped according to
netstat. Is this something I should troubleshoot further?# netstat -s|grep -Ei 'drop|fail'
933 outgoing packets dropped
72 dropped because of missing route
1 fragments dropped after timeout
1 packet reassemblies failed
219791 input ICMP message failed
0 ICMP messages failed
54122 failed connection attempts
2112 ICMP packets dropped because they were out-of-window
329 SYNs to LISTEN sockets dropped
TCPSackFailures: 250
TCPSackRecoveryFail: 232
TCPDeferAcceptDrop: 103900
linux networking fedora tcpdump netstat
edited Jul 12 at 2:47
slm♦
233k65479651
asked Jul 11 at 14:16
Alex Regan
11
I have three Fedora systems (one is a VM) connected to a cable modem and all three are showing dropped packets on the interface connected to the cable modem:
br0: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST> mtu 1500
inet 68.195.191.45 netmask 255.255.255.248 broadcast 68.195.191.47
inet6 ::16da:e9ff:fe97:ab71 prefixlen 64 scopeid 0x0<global>
inet6 fe80::16da:e9ff:fe97:ab71 prefixlen 64 scopeid 0x20<link>
ether 14:da:e9:97:ab:71 txqueuelen 1000 (Ethernet)
RX packets 343974520 bytes 362346759020 (337.4 GiB)
RX errors 0 dropped 1756203 overruns 0 frame 0
TX packets 379863195 bytes 161443693923 (150.3 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
My cable provider (cablevision/optonline/altice) reports there are no issues on their side. They've replaced their modem and even the line from the street. I really don't believe it's a cabling problem.
The bridge was created to support virtual machines. Here is the Ethernet interface directly attached to the modem:
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::ec4:7aff:fea9:18de prefixlen 64 scopeid 0x20<link>
ether 0c:c4:7a:a9:18:de txqueuelen 1000 (Ethernet)
RX packets 1049104943 bytes 1119862100182 (1.0 TiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 744768695 bytes 426022225424 (396.7 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device memory 0xfb120000-fb13ffff
First, what could explain dropped packets on any computer connected to this cable modem? I also don't believe it's a utilization issue.
Questions
- How can I use tcpdump to identify which packets are being dropped, and the reason why they are dropped?
- How can I tell if the system doesn't have enough kernel resources to keep all the received packets?
I've identified some packets which were dropped according to
netstat. Is this something I should troubleshoot further?# netstat -s|grep -Ei 'drop|fail'
933 outgoing packets dropped
72 dropped because of missing route
1 fragments dropped after timeout
1 packet reassemblies failed
219791 input ICMP message failed
0 ICMP messages failed
54122 failed connection attempts
2112 ICMP packets dropped because they were out-of-window
329 SYNs to LISTEN sockets dropped
TCPSackFailures: 250
TCPSackRecoveryFail: 232
TCPDeferAcceptDrop: 103900
linux networking fedora tcpdump netstat
edited Jul 12 at 2:47
slm♦
233k65479651
asked Jul 11 at 14:16
Alex Regan
11
edited Jul 12 at 2:47
slm♦
233k65479651
edited Jul 12 at 2:47
slm♦
233k65479651
edited Jul 12 at 2:47
slm♦
233k65479651
233k65479651
asked Jul 11 at 14:16
Alex Regan
11
asked Jul 11 at 14:16
Alex Regan
11
asked Jul 11 at 14:16
Alex Regan
11
11
Your interface name,br0suggests that that's a bridge, not the actual link to the cable modem.
– Andy Dalton
Jul 11 at 14:39
Isn't it possibly congestion on your machine? You don't have enough kernel resources to keep all the received packets. Eg are you trying to receive multicast packets or udp streams with no flow control?
– meuh
Jul 11 at 14:54
I've added the eth0 info and a question about kernel resources. How can I tell if a limit is being reached?
– Alex Regan
Jul 11 at 15:53
check out this suse support answer.ethtoolandnetstat -smay give insight. Read redhat's chapters on networking.
– meuh
Jul 11 at 17:04
thanks, I forgot about that. I've added what I believe is the relevant netstat output. Do I need to investigate further? There are apparently a lot of ICMP dropped packets...
– Alex Regan
Jul 12 at 0:01
 |Â
show 1 more comment
Your interface name,br0suggests that that's a bridge, not the actual link to the cable modem.
– Andy Dalton
Jul 11 at 14:39
Isn't it possibly congestion on your machine? You don't have enough kernel resources to keep all the received packets. Eg are you trying to receive multicast packets or udp streams with no flow control?
– meuh
Jul 11 at 14:54
I've added the eth0 info and a question about kernel resources. How can I tell if a limit is being reached?
– Alex Regan
Jul 11 at 15:53
check out this suse support answer.ethtoolandnetstat -smay give insight. Read redhat's chapters on networking.
– meuh
Jul 11 at 17:04
thanks, I forgot about that. I've added what I believe is the relevant netstat output. Do I need to investigate further? There are apparently a lot of ICMP dropped packets...
– Alex Regan
Jul 12 at 0:01
Your interface name,
br0 suggests that that's a bridge, not the actual link to the cable modem.– Andy Dalton
Jul 11 at 14:39
Your interface name,
br0 suggests that that's a bridge, not the actual link to the cable modem.– Andy Dalton
Jul 11 at 14:39
Isn't it possibly congestion on your machine? You don't have enough kernel resources to keep all the received packets. Eg are you trying to receive multicast packets or udp streams with no flow control?
– meuh
Jul 11 at 14:54
Isn't it possibly congestion on your machine? You don't have enough kernel resources to keep all the received packets. Eg are you trying to receive multicast packets or udp streams with no flow control?
– meuh
Jul 11 at 14:54
I've added the eth0 info and a question about kernel resources. How can I tell if a limit is being reached?
– Alex Regan
Jul 11 at 15:53
I've added the eth0 info and a question about kernel resources. How can I tell if a limit is being reached?
– Alex Regan
Jul 11 at 15:53
check out this suse support answer.
ethtool and netstat -s may give insight. Read redhat's chapters on networking.– meuh
Jul 11 at 17:04
check out this suse support answer.
ethtool and netstat -s may give insight. Read redhat's chapters on networking.– meuh
Jul 11 at 17:04
thanks, I forgot about that. I've added what I believe is the relevant netstat output. Do I need to investigate further? There are apparently a lot of ICMP dropped packets...
– Alex Regan
Jul 12 at 0:01
thanks, I forgot about that. I've added what I believe is the relevant netstat output. Do I need to investigate further? There are apparently a lot of ICMP dropped packets...
– Alex Regan
Jul 12 at 0:01
 |Â
show 1 more comment
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Â
draft saved
draft discarded
Â
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f454704%2fusing-tcpdump-to-identify-dropped-packets%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Your interface name,
br0suggests that that's a bridge, not the actual link to the cable modem.– Andy Dalton
Jul 11 at 14:39
Isn't it possibly congestion on your machine? You don't have enough kernel resources to keep all the received packets. Eg are you trying to receive multicast packets or udp streams with no flow control?
– meuh
Jul 11 at 14:54
I've added the eth0 info and a question about kernel resources. How can I tell if a limit is being reached?
– Alex Regan
Jul 11 at 15:53
check out this suse support answer.
ethtoolandnetstat -smay give insight. Read redhat's chapters on networking.– meuh
Jul 11 at 17:04
thanks, I forgot about that. I've added what I believe is the relevant netstat output. Do I need to investigate further? There are apparently a lot of ICMP dropped packets...
– Alex Regan
Jul 12 at 0:01