I have a network capture device running CentOS 7 that receives SPAN traffic from a core switch. Unfortunately, the kernel is dropping some packets (about ~0,05%). I installed dropwatch to investigate this issue and it reports drops in ip_rcv+c0:
Example:
5994 drops at ip_rcv+c0 (0xffffffff81509950)
5106 drops at ip_rcv+c0 (0xffffffff81509950)
3840 drops at ip_rcv+c0 (0xffffffff81509950)
6294 drops at ip_rcv+c0 (0xffffffff81509950)
3209 drops at ip_rcv+c0 (0xffffffff81509950)
Here is a link to that particular function (/net/ipv4/ip_input.c): http://lxr.free-electrons.com/source/net/ipv4/ip_input.c#L376
The function is supposed to do packet sanity checks, and the drop could possibly be caused by wierd packets, but Im not able to verify that as the packets are dropped. How can I debug / find out why these packets are getting dropped?
