2

I have a web appliance running CentOS 5.11. It sees a fair amount of traffic (apologies, I don't have specific numbers but I know it's in use).

For some reason, I'm seeing ifconfig error counts slowly incrementing on it. 

eth0      Link encap:Ethernet  HWaddr AA:BB:CC:DD:EE:FF  
          inet addr:1.1.1.1  Bcast:1.1.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:202723544 errors:0 dropped:4959 overruns:0 frame:37
          TX packets:158354057 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:4261083782 (3.9 GiB)  TX bytes:1224803677 (1.1 GiB)
          Interrupt:83 Memory:f6bf0000-f6c00000

(IP and MACs are renamed to protect the innocent).

The dropped count increases roughly 90-100 frames per day. Does this indicate any issues? Is this "normal"?

Also, what does frame:37 mean?

Mike B
  • 11,871
  • 42
  • 107
  • 168

2 Answers2

1

I came across a blog post that I believe answers this question:

Here's the lowdown:

  • RX packets: represent the total number of packets that were received. This includes ALLLLLLLLL network data units that made it to the interface (including stuff that was malformed/invalid/rejected).
  • (RX) errors: represent the number of packets that had "errors". A lot of documentation on the net is quick to label this counter as the number of frames that failed CRC checks. While that's certainly a possible explanation, that's not the ONLY reason why an error could occur. Other possibilities include (but aren't limited to):
    • Frames that are too long.
    • Ring-buffer overflow (The ring buffer is "a buffer that the NIC transfers frames to before raising an IRQ with the kernel")
    • fifo overruns (explained below)
    • Missed packets
  • (RX) overruns: represent the number of fifo overruns. Overruns are caused when kernel can't keep up with the rate that the ring-buffer is being drained at.
  • (RX) frames:represent the number of incoming frames that were misaligned (frame size that is indivisible by eight).

Sources:

http://searchnetworking.techtarget.com/tip/Common-network-errors-and-causes
http://www.gnu.org/software/inetutils/manual/inetutils.html
http://blog.hyfather.com/blog/2013/03/04/ifconfig/

Mike B
  • 11,871
  • 42
  • 107
  • 168
0

I believe "frame" is a count of the packets received with framing errors (which generally mean bad frame checksums). Some kind of corruption. Bad hardware somewhere is a likely cause, but you can see this with a duplex mismatch (full-duplex on one side, half on the other) so check that first.

You're not seeing that many, so it's likely a component that's marginal rather than totally failing.

Morven
  • 1,041
  • 1
  • 7
  • 15