netdata/health/guides/net/inbound_packets_dropped.md

Understand the alert

This alert is triggered when the number of inbound dropped packets for a network interface exceeds a specified threshold during the last 10 minutes. A dropped packet means that the network device could not process the packet, hence it was discarded.

What are the common causes of dropped packets?

1. Network Congestion: When the network traffic is too high, the buffer may overflow before the device can process the packets, causing some packets to be dropped.
2. Link Layer Errors: Packets can be dropped due to errors in the link layer causing frames to be corrupted.
3. Insufficient Resources: The network interface may fail to process incoming packets due to a lack of memory or CPU resources.

Troubleshoot the alert

1. Check the overall system resources

Run the vmstat command to get a report about your system statistics.

   vmstat 1

Check if the CPU or memory usage is high. If either is near full utilization, consider upgrading system resources or managing the load more efficiently.

1. Check network interface statistics

Run the ifconfig command to get more information on the network interface.

   ifconfig <INTERFACE>

Look for the RX dropped field to confirm the number of dropped packets.

1. Monitor network traffic

Use iftop or nload to monitor the network traffic in real time. If you don't have these tools, install them:

   sudo apt install iftop nload

   iftop -i <INTERFACE>
   nload <INTERFACE>

Identify if there is unusually high traffic on the network interface.

1. Check logs for any related errors

Check the system logs for any errors related to the network interface or driver:

   sudo dmesg | grep -i "eth0"
   sudo journalctl -u networking.service

If you find any errors, you can research the specific problem and apply the necessary fixes.