[netsa-tools-discuss] yaf rejected packets

[Chris Inacio]

From: Bistmans, Leo <leo.bistmans at uza.be><mailto:leo.bistmans at uza.be>
Reply: Bistmans, Leo <leo.bistmans at uza.be><mailto:leo.bistmans at uza.be>
Date: March 3, 2017 at 11:06:18 AM
To: netsa-tools-discuss at cert.org <netsa-tools-discuss at cert.org><mailto:netsa-tools-discuss at cert.org>
Subject:  [netsa-tools-discuss] yaf rejected packets

[2017-01-27 10:59:07] Processed 1786701 packets into 36580 flows:
[2017-01-27 10:59:07] Mean flow rate 0.53/s.
[2017-01-27 10:59:07] Mean packet rate 25.67/s.
[2017-01-27 10:59:07] Virtual bandwidth 0.1761 Mbps.
[2017-01-27 10:59:07] Maximum flow table size 67.
[2017-01-27 10:59:07] 13657 flush events.
[2017-01-27 10:59:07] 30595 asymmetric/unidirectional flows detected (83.64%)
[2017-01-27 10:59:07] YAF read 18456072 total packets
[2017-01-27 10:59:07] Assembled 36 fragments into 0 packets:
[2017-01-27 10:59:07] Expired 15 incomplete fragmented packets. (0.00%)
[2017-01-27 10:59:07] Maximum fragment table size 4.
[2017-01-27 10:59:07] Rejected 16669335 packets during decode: (47.46%)
[2017-01-27 10:59:07] 16669335 due to unsupported/rejected packet type: (47.46%)
[2017-01-27 10:59:07] 16669335 unsupported/rejected Layer 3 headers. (47.46%)
[2017-01-27 10:59:07] 6435584 ARP packets. (18.32%)
[2017-01-27 10:59:07] 2322 LLDP packets. (0.01%)
[2017-01-27 10:59:07] 10204677 802.3 packets. (29.05%)

Fear of missing out on this high level of rejected packets.
What would be best way to find out which type of data that gets discarded from statistics?


yaf can be compiled for powerpc based network switch with CumulusLinux 2.5.x It is now feeding ipfix into a Flowmon collector tool.

Regards,
Leo Bistmans

Leo,

Are you running MPLS?
Can you tell us how you configured yaf, which options?  (the output from `yaf —version` will do it.)

We very much want to make sure that you aren’t losing 47% of your packets.

regards,
--
Chris Inacio
inacio at cert.org<mailto:inacio at cert.org>



-------------- next part --------------
HTML attachment scrubbed and removed