Transmit and Receive Discards

Solarwinds is reporting Receive and Transmit errors from our Nokia Firewall.

The Nokia has two Interfaces (inside and outside) The inside indicates Receive discards and Receive Errors. Note: thousands per day.

The outside interface indicates Transmit Discards. Note: Millions per day.

The interface is connected to a 6513 gig port. We've turned on Flow Control on the Cisco and Nokia Interface. This has helped some, but the outside Nokia Interface still registers millions on Transmit discards.

Here is the netstat-ni on the Nokia.

Name Mtu Network Address Ipkts Ierrs Opkts Oerrs Coll
eth-s1p1 1518 <Link> 0:a0:8e:33:33:0 1655951919 6575 4143547978 0 0
eth-s2p1 1518 <Link> 0:a0:8e:33:33:4 2926538897 23064476 3458402147 0 0

Has anyone experienced this before? We have plenty of bandwidith, so I assume the Transmit Buffer can't handle the data bursts. I'm not sure how to grow this Buffer. Does anyone know?

Could it be hardware?

Find more posts tagged with

Accepted answers

All comments

Network_Guru

Iceman,

There are many different reasons for discarded packets.
It does not necessarily mean there is a problem with your firewall.

Have a look at these posts:

www2.solarwinds.net/.../topic.asp

www2.solarwinds.net/.../topic.asp

The discards can also be caused by packets with an MTU size that is to large and have the DF bit set. I have a Cisco router that is the endpoint of an IPSec tunnel which reduces the MTU size to less than 1500. With servers (both Windows and Linux) doing PMTU discovery, they occasionally send out packets with the DF bit set and the packets are too large to go through the tunnel. The Cisco router reports these as discards.

They might also be held in the buffer too long, & discarded, if your FW rules are too long and not being processed in a timely manner.
Do the discards only show up during peak traffic periods, or are they constant regardless of load?

-=Cheers=-
NG

iceman

Thanks Network_Guru.

The discards are only indicated on our peak times. During Off-Hours including weekends NO Discards are indicated.

We have a Nokia Firewall. Both the gig interfaces share a common controller, so Nokia suggests moving one interface to another controller. We're doing that today.

Our issue seems to be throughput. Our pipe is big enough, but the data bursts seem to be issues.

The flow control implementation helped somewhat on the receive dicards (50%).