[netsa-tools-discuss] yaf rejected packets

[Bistmans, Leo]

[2017-01-27 10:59:07] Processed 1786701 packets into 36580 flows:
[2017-01-27 10:59:07]   Mean flow rate 0.53/s.
[2017-01-27 10:59:07]   Mean packet rate 25.67/s.
[2017-01-27 10:59:07]   Virtual bandwidth 0.1761 Mbps.
[2017-01-27 10:59:07]   Maximum flow table size 67.
[2017-01-27 10:59:07]   13657 flush events.
[2017-01-27 10:59:07]   30595 asymmetric/unidirectional flows detected (83.64%)
[2017-01-27 10:59:07] YAF read 18456072 total packets
[2017-01-27 10:59:07] Assembled 36 fragments into 0 packets:
[2017-01-27 10:59:07]   Expired 15 incomplete fragmented packets. (0.00%)
[2017-01-27 10:59:07]   Maximum fragment table size 4.
[2017-01-27 10:59:07] Rejected 16669335 packets during decode: (47.46%)
[2017-01-27 10:59:07]   16669335 due to unsupported/rejected packet type: (47.46%)
[2017-01-27 10:59:07]     16669335 unsupported/rejected Layer 3 headers. (47.46%)
[2017-01-27 10:59:07]     6435584 ARP packets. (18.32%)
[2017-01-27 10:59:07]     2322 LLDP packets. (0.01%)
[2017-01-27 10:59:07]     10204677 802.3 packets. (29.05%)

Fear of missing out on this high level of rejected packets.
What would be best way to find out which type of data that gets discarded from statistics?


yaf can be compiled for powerpc based network switch with CumulusLinux 2.5.x  It is now feeding ipfix into a Flowmon collector tool.

Regards,
Leo Bistmans