Linux 如何找到哪些数据包被丢弃
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/8987926/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
how to find which packets got dropped
提问by Hoelli
I'm getting thousands of dropped packages from a Broadcom Network Card:
我从 Broadcom 网卡收到数千个丢弃的包：
eth1 Link encap:Ethernet HWaddr 01:27:B0:14:DA:FE
UP BROADCAST RUNNING SLAVE MULTICAST MTU:1500 Metric:1
RX packets:2746252626 errors:0 dropped:1151734 overruns:0 frame:0
TX packets:4109502155 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:427998700000 (408171.3 Mb) TX bytes:3530782240047 (3367216.3 Mb)
Interrupt:40 Memory:d8000000-d8012700
Here is the installed version:
这是安装的版本：
filename: /lib/modules/2.6.27.54-0.2-default/kernel/drivers/net/bnx2.ko
version: 1.8.0
license: GPL
description: Broadcom NetXtreme II BCM5706/5708/5709 Driver
The packets get dropped in bulks ranging from 500 to 5000 packets several times an hour. The Server (running Postgres) is running fine - just the dropps are annoying.
数据包每小时多次丢弃 500 到 5000 个数据包。服务器（运行 Postgres）运行良好 - 只是 dropps 很烦人。
After trying lots of different things, I'm asking: How may I find out where the packets came from and why were they dropped?
在尝试了很多不同的事情之后，我问：我如何才能找出数据包的来源以及它们为什么被丢弃？
采纳答案by Cameron Kerr
(For the benefit of those that come to this via a search) I've seen the same problem (also with a bnx2 module, IIRC).
（为了那些通过搜索来到这里的人的好处）我看到了同样的问题（还有一个 bnx2 模块，IIRC）。
You might try turning off the irqbalance service. In my case, it completely stopped the solution.
您可以尝试关闭 irqbalance 服务。就我而言，它完全停止了解决方案。
Please also note that not so long ago, there were plenty of updates (RHEL 6) for irqbalance. Firmware updates should also be checked for both main system and the ethernet board(s).
另请注意，不久前，irqbalance 有大量更新（RHEL 6）。还应检查主系统和以太网板的固件更新。
We were seeing this only a very large subnet with a very large amount of broadcast/multicast activity. We weren't seeing this on the same equipment on a less noisy -- but still very active -- part of the network.
我们看到这只是一个非常大的子网，有大量的广播/多播活动。我们没有在相同设备上的噪音较小但仍然非常活跃的网络部分上看到这种情况。
Potentially, setting the ethernet ring buffer size for the NIC can also be of use. I know there were some alterations for sysctl on that busy network...
潜在地，也可以使用为 NIC 设置以太网环缓冲区大小。我知道在那个繁忙的网络上对 sysctl 进行了一些改动......
回答by Christopher Neylan
A dropped packet means that the buffer that is used to store the packet for forwarding/processing is full. The act of looking into the packet's data for information implies that you have the data to look at in the first place (which you don't, because there was no room to store it).
丢弃的数据包意味着用于存储用于转发/处理的数据包的缓冲区已满。查看数据包的数据以获取信息的行为意味着您首先要查看数据（您没有，因为没有空间存储它）。
A nice way around this, so you can see what data is being dropped, is to look through a dump of your traffic for the TCP retransmission requests leaving your server. When a TCP packet is missing, for whatever reason, your server is going to ask for it to be re-sent. The retransmit will give you the conversation context that you're looking for.
一个很好的方法来解决这个问题，以便您可以看到正在丢弃哪些数据，就是查看您的流量转储，以查找离开您的服务器的 TCP 重新传输请求。当 TCP 数据包丢失时，无论出于何种原因，您的服务器都会要求重新发送它。重新传输将为您提供您正在寻找的对话上下文。
I'd actually suggest taking a look at the switch/router that your server is connected to. It will be able to give you a nice idea of the loss and throughput over the interface to your server, letting you diagnose, for example, if your card is too slow for the wire.
我实际上建议查看您的服务器连接到的交换机/路由器。它将能够让您很好地了解服务器接口上的损耗和吞吐量，例如，让您诊断您的卡是否对线路来说太慢。
EDIT
编辑
This blog postcites a tool called dropwatch, which may give you some clues as well.
这篇博文引用了一个名为 的工具dropwatch，它也可以为您提供一些线索。
回答by n00ris
You may ran into https://www.novell.com/support/kb/doc.php?id=7007165.
您可能会遇到https://www.novell.com/support/kb/doc.php?id=7007165。
quote:
引用：
Beginning with kernel 2.6.37, it has been changed the meaning of dropped packet count. Before, dropped packets was most likely due to an error. Now, the rx_dropped counter shows statistics for dropped frames because of:
从内核 2.6.37 开始，已更改丢弃数据包计数的含义。以前，丢包很可能是由于错误造成的。现在， rx_dropped 计数器显示丢失帧的统计信息，因为：
Softnet backlog full -- (Measured from /proc/net/softnet_stat)
Softnet backlog full --（从/proc/net/softnet_stat 测量）
Bad / Unintended VLAN tags
错误/意外的 VLAN 标记
Unknown / Unregistered protocols
未知/未注册的协议
IPv6 frames when the server is not configured for IPv6
服务器未配置为 IPv6 时的 IPv6 帧
If any frames meet those conditions, they are dropped before the protocol stack and the rx_dropped counter is incremented.
如果任何帧满足这些条件，它们会在协议栈之前被丢弃，并且 rx_dropped 计数器会增加。
