cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

AMD excessive lost packet count

cosmin_gherghel
Dynatrace Pro
Dynatrace Pro

System Status page shows 99% of lost packets since midnight. I do not see any issues with the AMD, no decrease in traffic or usage, SSL is working correctly no alarms other than high number of duplicate packets. 

 

What is the high packet loss indicating?

 

12 REPLIES 12

ulf_thorn222
Inactive

What is your source of packets?

Are you referring to the AMD as the source or the actual IP addresss of the source of the packets?

harshal_pujari
Dynatrace Pro
Dynatrace Pro

Hi Cosmin,

Can you please attach rtm_perf.log?

ulf_thorn222
Inactive

What I was asking for is from where the packets come - are they from a SPAN, a VACL or a TAP or some other solution?

Packets are coming from an Apcon TAP.

adam_piotrowicz
Dynatrace Pro
Dynatrace Pro

Cosmin,

What is your RUM Console -> Configuration -> Global -> General -> Deduplication method set to?

Is this your only AMD attached to this CAS? And if not then sorry for the question but are you sure provided rtm_perf.log comes from the correct one ? (smile)

cosmin_gherghel
Dynatrace Pro
Dynatrace Pro

Hi Adam,

Packet deduplication method is "TCP checksum and IP ID". This is the second AMD attached to the CAS and yes I double checked the rtm_perf.log is coming from the correct AMD.

 

 

Cosmin,

Dropped packets from this report means the AMD misses some packets due to overload (usually), but lost packets means that packets were lost outside AMD, somewhere on the network.

Anyway the value 99% on this report in the light of the rtm_perf.log look slike a bug.

Can you please provide us with rtm.log and one day of amdstatsdata data files and wrap them in support ticket?

ulf_thorn222
Inactive

Hi

Your log file isn't indicating any dropped packets or receive problems but I get concerned about the naming of the interfaces.

Why do you have an interface called BOND (are you using some BOND/teaming software) and why do you have so many interfaces?

Where exactly do you see the 99% packet loss?

Is it a simple TAP or do you have the aggregation device?

Can you attach something else and see if the output from the TAP is alright?

BOND is a virtual interface. The em# interfaces are the onboard interfaces while the p#p# are the NICs that were bought for sniffing but only one is used that is connected to the AppCon which is a port aggregator. The packet loss is seen in the CAS from the system status page, but nowhere else. Data is being collected and processed from the AMD that is being recorded with the packet loss. 

ulf_thorn222
Inactive

OK - Clear on that.

Do you have a chance to attach something else to the output from that aggregation device?

If you can't do that to verify the quality of the packet stream I'd suggest you open a ticket with support so they can try to pinpoint what's going on.