Difference between "receive errors" and "receive incoming errors" under hardware interface counters
52152
Created On 08/18/21 01:53 AM - Last Modified 02/05/22 05:52 AM
Question
- What is the difference between "receive errors" and "receive incoming errors" seen under show counter interface <interface name>
show counter interface ethernet1/7 ... Hardware interface counters read from CPU: -------------------------------------------------------------------------------- bytes received 184768201250 bytes transmitted 445176504740 packets received 512968615 packets transmitted 662817007 receive incoming errors 0 receive discarded 0 receive errors 631050 packets dropped 0 --------------------------------------------------------------------------------
Environment
- Palo Alto Firewall
Answer
Receive error:
Receive Errors show the count of any receive errors received on the physical (hardware) interface. They are primarily L2-L4 parsing/header errors and although the counter mentions "hardware," they are predominantly logical errors (CRC, framing or other hardware-related errors are NOT counted here).
Most common types of events that cause these errors are
- incorrect length of VLAN tag
- unexpected VLAN tag
- unsupported L2 protocol
- incorrect IP checksum
- TCP/UDP packet checksum error
- TCP/UDP port 0
- Invalid TCP flag, etc.
Very often, a constant increase of this counter is caused by STP/LLDP/UDLD frames arriving on a L3 firewall port (these protocols are not supported on L3 ports and are legitimately dropped and counted as "Receive errors").
Receive incoming error:
This sums up two different types of error collected from interface statistics:
- mac_rcv_error: MAC address of packet received doesn't match ingress interface MAC address.
- rcv_fifo_overrun: Overruns occur when the buffer of the interface is full, but it is still trying to handle incoming traffic. The port has exceeded its buffer. This is usually due to bursty traffic more than anything else.
Additional Information
WHAT IS THE FIFO_OVERRUN COUNTER?
THE DIFFERENCE BETWEEN RECEIVE ERRORS FOR HARDWARE AND LOGICAL INTERFACE COUNTER