| 1 | ### Understand the alert |
| 2 | |
| 3 | Packet drops indicate that your system received some packets but could not process them. A sizeable amount of packet drops can consume significant amount of resources in your system. Some reasons that packets drops occurred in your system could be: |
| 4 | |
| 5 | - Your system receives packets with bad VLAN tags. |
| 6 | - The packets you are receiving are using a protocol that is unknown to your system. |
| 7 | - You receive IPv6 packets, but your system is not configured for IPv6. |
| 8 | |
| 9 | All these packets consume resources until being dropped (and for a short period after). For example, your NIC stores them in a ring-buffer until they are forwarded to the destined subsystem or userland application for further process. |
| 10 | |
| 11 | Netdata calculates the ratio of inbound dropped packets for your wired network interface over the last 10 minutes. |
| 12 | |
| 13 | ### Identify VLANs in your interface |
| 14 | |
| 15 | There are cases in which traffic is routed to your host due to the existence of multiple VLAN in your network. |
| 16 | |
| 17 | 1. Identify VLAN tagged packet in your interface. |
| 18 | |
| 19 | ``` |
| 20 | tcpdump -i <your_interface> -nn -e vlan |
| 21 | ``` |
| 22 | |
| 23 | 2. Monitor the output of the `tcpdump`, identify VLANs which may exist. If no output is displayed, your interface probably uses traditional ethernet frames. |
| 24 | |
| 25 | 3. Depending on your network topology, you may consider removing unnecessary VLANs from the switch trunk port toward your host. |
| 26 | |
| 27 | ### Update the ring buffer size on your interface |
| 28 | |
| 29 | 1. To view the maximum RX ring buffer size: |
| 30 | |
| 31 | ``` |
| 32 | ethtool -g enp1s0 |
| 33 | ``` |
| 34 | |
| 35 | 2. If the values in the Pre-set maximums section are higher than in the current hardware settings section, increase RX |
| 36 | ring buffer: |
| 37 | |
| 38 | ``` |
| 39 | enp1s0 rx 4080 |
| 40 | ``` |
| 41 | |
| 42 | 3. Verify the change to make sure that you no longer receive the alarm when running the same workload. To make this |
| 43 | permanently, you must consult your distribution guides. |
| 44 | |
| 45 | |
| 46 | ### Inspect the packets your network interface receives |
| 47 | |
| 48 | Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development. |
| 49 | |
| 50 | ### Useful resources |
| 51 | |
| 52 | [Read more about Wireshark here](https://www.wireshark.org/) |