Understand the alert
This alert is triggered when the number of inbound dropped packets for a network interface exceeds a specified threshold during the last 10 minutes. A dropped packet means that the network device could not process the packet, hence it was discarded.
What are the common causes of dropped packets?
- Network Congestion: When the network traffic is too high, the buffer may overflow before the device can process the packets, causing some packets to be dropped.
- Link Layer Errors: Packets can be dropped due to errors in the link layer causing frames to be corrupted.
- Insufficient Resources: The network interface may fail to process incoming packets due to a lack of memory or CPU resources.
Troubleshoot the alert
- Check the overall system resources
Run the vmstat command to get a report about your system statistics.
vmstat 1
Check if the CPU or memory usage is high. If either is near full utilization, consider upgrading system resources or managing the load more efficiently.
- Check network interface statistics
Run the ifconfig command to get more information on the network interface.
ifconfig <INTERFACE>
Look for the RX dropped field to confirm the number of dropped packets.
- Monitor network traffic
Use iftop or nload to monitor the network traffic in real time. If you don't have these tools, install them:
sudo apt install iftop nload
iftop -i <INTERFACE>
nload <INTERFACE>
Identify if there is unusually high traffic on the network interface.
- Check logs for any related errors
Check the system logs for any errors related to the network interface or driver:
sudo dmesg | grep -i "eth0"
sudo journalctl -u networking.service
If you find any errors, you can research the specific problem and apply the necessary fixes.