[Oisf-users] tcp.segment_memcap_drop

[Kurzawa, Kevin]

Using pcap because ... well, I don't know any better? I guess I don't really know the alternatives. PF Ring is the other option right? 

Is this the potential source of the tcp.reassembly_gap? 


> Tcp gap  means your not seeing the whole tcp stream traffic 
> (there are gaps in the tcp stream/s), that could also relate to drops.
> 1902749 is a lot of gaps in my opinion for 16 hrs.

> What is the reason  you use pcap mode?

> -------------------------------------------------------------------
> Date: 6/11/2014 -- 09:11:12 (uptime: 0d, 16h 08m 30s)
> -------------------------------------------------------------------
> Counter                   | TM Name                   | Value
> -------------------------------------------------------------------
> capture.kernel_packets    | RxPcapbond01              | 405967168
> capture.kernel_drops      | RxPcapbond01              | 449953
> capture.kernel_ifdrops    | RxPcapbond01              | 0
> tcp.sessions              | Detect                    | 4552548
> tcp.ssn_memcap_drop       | Detect                    | 0
> tcp.segment_memcap_drop   | Detect                    | 8401072
> tcp.stream_depth_reached  | Detect                    | 3298
> tcp.reassembly_memuse     | Detect                    | 8589934576
> tcp.reassembly_gap        | Detect                    | 1902749