This is a real life sample alert from indeni, the World leader in Proactive Network Management.

Description:

Some network traffic may be lost or slowed down. Review the list of affected NICs below. Indeni will re-check this alert every 1 minute. If indeni determines the issue has been resolved, it will automatically be flagged as such.

Affected NICs:

eth5 (Bandwidth: 100M/full, MAC Address: 00:1C:7F:31:23:D8)

The eth5 (Bandwidth: 100M/full, MAC Address: 00:1C:7F:31:23:D8) network interface has dropped some of the packets received: 55,033 out of 4,975,627 (1.106%) over the past 1 Second. The RX ring size is set to 256.

Manual Remediation Steps:

Please ensure that all physical network connections are in place, all routers and switches are properly configured and identify any recent changes which may be causing this. If you believe these drops are caused by bursty traffic, you may want to increase the RX and/or TX ring sizes.

The ring is a circular buffer used to store packets as they enter or exit the device through a NIC (like a queue). The buffer may be full if there is a bottle neck in handling traffic. If the traffic is consistently high, increasing the buffer will not help as the bottleneck will still happen. If the traffic is bursty, increasing the buffer will allow the slow element (such as CPU) more time to handle packets and clear the buffer before the next burst of packets comes through.

For more information see SK42181.

How does this alert work?

indeni monitors the critical stats of all network interfaces and ports constantly. When issues are found, such as drops, indeni attempts to determine the source. As part of this process, indeni will cross check known best practices depending on device type. In this case, the device is running Check Point Secure Platform, therefore the information displayed is relevant to that product.

This and many more Check Point Firewall alerts are share on our monthly newsletter.