Error:
An unexpected error occurred. Please click Reload to try again.
Error:
An unexpected error occurred. Please click Reload to try again.
Difference between "receive errors" and "receive incoming errors" under hardware interface counters

Difference between "receive errors" and "receive incoming errors" under hardware interface counters

52152
Created On 08/18/21 01:53 AM - Last Modified 02/05/22 05:52 AM


Question


  • What is the difference between "receive errors" and "receive incoming errors" seen under show counter interface <interface name>
show counter interface ethernet1/7

...

Hardware interface counters read from CPU:
--------------------------------------------------------------------------------
bytes received                           184768201250
bytes transmitted                        445176504740
packets received                         512968615
packets transmitted                      662817007
receive incoming errors                  0
receive discarded                        0
receive errors                           631050
packets dropped                          0
--------------------------------------------------------------------------------


Environment


  • Palo Alto Firewall


Answer


 Receive error:

Receive Errors show the count of any receive errors received on the physical (hardware) interface. They are primarily L2-L4 parsing/header errors and although the counter mentions "hardware," they are predominantly logical errors (CRC, framing or other hardware-related errors are NOT counted here).

Most common types of events that cause these errors are

  • incorrect length of VLAN tag
  • unexpected VLAN tag
  • unsupported L2 protocol
  • incorrect IP checksum
  • TCP/UDP packet checksum error
  • TCP/UDP port 0
  • Invalid TCP flag, etc.

Very often, a constant increase of this counter is caused by STP/LLDP/UDLD frames arriving on a L3 firewall port (these protocols are not supported on L3 ports and are legitimately dropped and counted as "Receive errors").


 Receive incoming error:

This sums up two different types of error collected from interface statistics:

  1. mac_rcv_error: MAC address of packet received doesn't match ingress interface MAC address.
  2. rcv_fifo_overrun: Overruns occur when the buffer of the interface is full, but it is still trying to handle incoming traffic. The port has exceeded its buffer. This is usually due to bursty traffic more than anything else. 


Additional Information


 WHAT IS THE FIFO_OVERRUN COUNTER?
THE DIFFERENCE BETWEEN RECEIVE ERRORS FOR HARDWARE AND LOGICAL INTERFACE COUNTER


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004Le6CAE&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language