# capture\_loss vs. pkts\_dropped vs. missed\_bytes
**URL:** https://community.zeek.org/t/capture-loss-vs-pkts-dropped-vs-missed-bytes/5685
**Category:** Zeek
**Created:** [May 2, 2019, 5:01pm UTC](https://community.zeek.org/t/capture-loss-vs-pkts-dropped-vs-missed-bytes/5685 "2019-05-02T17:01:36Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Mark\_Gardner](https://community.zeek.org/u/Mark_Gardner)
#### Post date: [May 2, 2019, 5:01pm UTC](https://community.zeek.org/t/capture-loss-vs-pkts-dropped-vs-missed-bytes/5685/1 "2019-05-02T17:01:36Z")
I am still tuning our new Zeek cluster: an Arista switch for load balancing with 4x10 Gbps links from a Gigamon and 10 Gbps links to the sensors, five sensors (16 physical cores with 128 GB RAM each) using af\_packet, 15 workers per sensor, and a separate management node running the manager, logger, proxy, and storage (XFS on RAID-0 with 8 7200 RPM spindles, 256 GB RAM). Output is JSON (for feeding into an ElasticStack later).
The average capture loss was \<1% early on with spikes to 50-70%. We increased the af\_packet\_buffer\_size from the default (128MB) to 2GB and capture\_loss is gone.
$ zcat capture\_loss.10:00:00-11:00:00.log.gz | jq .percent\_lost | statgen
Count Min Max Avg StdDev
300 0.0000 0.0000 0.0000 0.0000
Next, I looked at the missing bytes from the conn.log which doesn’t look too bad:
$ zcat conn.10:00:00-11:00:00.log.gz | jq .missed\_bytes | statgen
Count Min Max Avg StdDev
5488 0.0000 5802.0000 1.7332 92.9547
Out of the 5488 records, only two were non-zero (5802 and 3710) and for both of those the missed\_bytes == resp\_bytes (service: ssl).
But even with the above, the pkts\_dropped in stats.log is extremely high:
$ zcat stats.10:00:00-11:00:00.log.gz | jq .pkts\_dropped | grep -v null | statgen
Count Min Max Avg StdDev
900 3564854 18216752 5762446.99 1591145.34
So even though there was no capture\_loss and almost no missing\_bytes, the pkts\_dropped is huge. Is this something to be concerned about? If so, I am not sure how to go about figuring out the problem. What should I do next?
---
### Author:  [@Michal\_Purzynski1](https://community.zeek.org/u/Michal_Purzynski1)
#### Post date: [May 2, 2019, 7:49pm UTC](https://community.zeek.org/t/capture-loss-vs-pkts-dropped-vs-missed-bytes/5685/2 "2019-05-02T19:49:33Z")
Hey Mark,
First of all, I really like your setup and I don’t see any obvious errors there. Cool.
Jan (also on this list) might know more about the way drops are calculated in stats log. It looks like they are just af\_packet statistics.
Can you run Justin’s troubleshooting tool and send us results?
[https://github.com/ncsa/bro-doctor](https://github.com/ncsa/bro-doctor)
BTW, while monitoring for drops, take a look here, where we describe several other places drops might happen (and all of them should be monitored).
[https://github.com/pevma/SEPTun/blob/master/SEPTun.rst#packet-drops](https://github.com/pevma/SEPTun/blob/master/SEPTun.rst#packet-drops)
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/capture-loss-vs-pkts-dropped-vs-missed-bytes/5685/3 "2022-05-06T15:46:28Z")