# missed bytes without gaps **URL:** \ **Category:** Zeek\ **Created:** [December 18, 2013, 12:57pm UTC](https://community.zeek.org/t/missed-bytes-without-gaps/2943 "2013-12-18T12:57:49Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![sangdrax8](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@sangdrax8](https://community.zeek.org/u/sangdrax8)\ **Post date:** [December 18, 2013, 12:57pm UTC](https://community.zeek.org/t/missed-bytes-without-gaps/2943/1 "2013-12-18T12:57:49Z")
I am confused on how I am getting “missed\_bytes.” When I read the documentation it says that these are due to content gaps, and is caused by packet loss. So I have tried to look for signs of this, but I have yet to find anything that shows content gaps or any significant packet loss. I see no mention of content gaps in my notices.log file, and my packet loss report from broctl shows almost no dropped packets (recvd=2770338 dropped=92 link=2770430) Perhaps I am looking at this wrong, so if someone could help out here it would be greatly appreciated. I am logging correct streams, vs streams with missed bytes, to see how often these missed bytes show up. To do this I am filtering my logs in the following way Missed: only looking at bro\_conn, orig\_bytes AND resp\_bytes \> 0, only TCP packets, missed\_bytes \> 0 Non-missed: only looking at bro\_conn, orig\_bytes AND resp\_bytes \> 0, only TCP packets, missed\_bytes = 0 Using these two definitions, I see almost 40% of my packets fall into the “missed” streams, while around 60% fall into the non-missed. I was doing this to check my setup and see if I had everything working. From everything else (no gaps reported, and no almost no dropped packets) I thought everything was working. Now I question if something else is wrong, and so I am weary about using this to look at other data as it may not be complete. ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [December 18, 2013, 1:22pm UTC](https://community.zeek.org/t/missed-bytes-without-gaps/2943/2 "2013-12-18T13:22:48Z")
There are a lot of reasons that you could be missing traffic that have nothing to do with the packet drop statistics reported by your NIC. I have a guess about what's happening in your traffic though. Have you disabled the special features on your NIC? Refer to this blog post on how to do it on linux:   [http://blog.securityonion.net/2011/10/when-is-full-packet-capture-not-full.html](http://blog.securityonion.net/2011/10/when-is-full-packet-capture-not-full.html) If you want a much better mechanism to see if you're receiving all of the traffic you should be I recommend loading the misc/capture-loss script. By default it will write out to capture\_loss.log every 15 minutes and due to it taking measurements of TCP streams themselves it can even detect packet loss occurring before the packets arrive at your monitoring interface. A number of people have detected faulty packet distribution boxes and overloaded switch SPAN ports with it.   .Seth ---
**Author:** ![sangdrax8](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@sangdrax8](https://community.zeek.org/u/sangdrax8)\ **Post date:** [December 18, 2013, 1:51pm UTC](https://community.zeek.org/t/missed-bytes-without-gaps/2943/3 "2013-12-18T13:51:19Z")
Wow thank you this was exactly my problem! I have turned these settings off and in the last 5 minute window my missed bytes went from ~40% to 0%. Perhaps a quick note in the doc's could point others to offloading features in NIC's as well because this fixed everything for me! ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/missed-bytes-without-gaps/2943/4 "2022-05-06T15:41:28Z")