cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

TCP Sessions with Missing Packets

BabarQayyum
Leader

Hello Everyone,

We have a situation that one of our AMD is missing the TCP sessions near about 5% and after reviewed we found that few software services created to monitor the applications have 100% missing sessions.

AMD is performing well without any drop packets or running out any other resources.

What could be the issue?

Below screenshots are reference to my question.

Regards,

Babar

6 REPLIES 6

ulf_thornander3
Inactive

It's most likely depending on how you capture the packets to your AMD.
How is it done today?

,

Very likely it's your feed. How are the packets captured and directed to the the AMD?

Hello Ulf,

Thank you for your reply.

We have a span from core switches to Aggregators and then to AMDs.

Below screenshot is a reference for the analyzer and missing sessions.

Regards,

Babar

ulf_thornander3
Inactive

So - most likely the SPAN is the source of your problem. I've posted a couple of times before but it's worth repeating - SPAN has very limited value in a production environment. Your best bet for success is have a target port that is much higher in speed than your source ports, and still you can fail 🙂 so that's why you should use a TAP instead.
http://www.lovemytool.com/blog/2007/08/span-ports-...

In the manual (assuming you are on 12.4)

https://community.dynatrace.com/community/display/...

Hello Ulf,

We have AMD Version:
12.3.8.6 and the below two screenshots are taken from the two different AMDs. The weird thing is that only the application traffic is missing 100% on the DH-1 side and the partially missing traffic for the same application(s) on the DH-2.

One more observation that the configured analyzer is HTTP which is showing 100% missing session in DH-1 AMD but for the Unknown TCP there is no missing session.

The same application in the DH-2 AMD is partially missing the traffic and that is also for the HTTP analyzer.

DH-1 Aggregator

DH-2 Aggregator

Regards,

Babar

ulf_thornander3
Inactive

Hey Babar - Now I had time to look a little more on you screen - your AMD is also sampling - never good!

https://answers.dynatrace.com/questions/151490/und...

Is it overloaded?

Hello Ulf,

As per our understanding AMD is not under performing, therefore, I took below screenshots for your understanding, might be we are missing something or overlooked.

AMD Health

AMD Settings

Interface Utilization

Packet Distribution (Driver Level)

Regards,

Babar