Rejected Packets

[dfusion]

I'm still doing a capture between my AS400 and Stratus and in the Capture Panel (Detail View) I'm seeing (roughly):

#seen 15,000
#dropped 0
#accepted 85,000
#rejected 64,000

I have the AS400 and Stratus both plugged into my Foundry switch. I am mirroring the Stratus port and have a filter inside Sniffer so I'm only capturing IP traffic <-> those two machines.



Sr. Network Engineer
ArcLight Systems, LLC

http://www.markholloway.com

 

[AZeemeri]

The rejected packets are the filtered out frames according to me.. what is your question?

 

[dfusion]

I'm not sure why there are so many Rejected packets, unless these are ones that don't match my Sniffer Filter for this capture....?

I am mirroring a port (AS400) and the Stratus is only one of many devices sending data. I created a filter in Sniffer so only those two devices capture packets. The rejected packets are the 'other' packets?

Thanks,
Mark


Sr. Network Engineer
ArcLight Systems, LLC

http://www.markholloway.com

 

[rwullems]

Hi Mark,

Don't know if the figures in you first post are the correct one, but normally the rejected and accepted added together should be the seen ammount of packets.

Dropped packets means that sniffer can not keep up and is dropping packets, so your measurment is not to be trusted anymore.

So, again, if the figures in your first post are correct, this seems very strange to me.
Regards,
Robert

Robert A.H. Wullems
Sniffer University Instructor
SCM / CNX / MCP
Citee Education
the Netherlands

 

[AlexTovar]

Mark:

Are you sure that distribution is correct ?

#seen 15,000
#dropped 0
#accepted 85,000
#rejected 64,000

# Packets Seen are supposed to be ALL the traffic on your segment, the Accepted the ones that passed through your filter, and the Rejected those that werent accepted by your filter. If packet seen are less than the other, there must be something wrong with your system.

I made a little excercise: Only accept ping from a certain PC:

#Seen: 399 ( all the segment )
#Dropped: 0
#Accepted: 8 ( Ping )
#Rejected: 391 ( Other different than ping )

As you can see, packet seen are more than any other counter.

Hope this helps.

Alex.

 

[dfusion]

I'm sorry, packets seen was approximately 150,000.

Sr. Network Engineer
ArcLight Systems, LLC

http://www.markholloway.com