# Question about capture loss script vs. broctl netstats **URL:** \ **Category:** Zeek\ **Created:** [June 25, 2013, 5:50pm UTC](https://community.zeek.org/t/question-about-capture-loss-script-vs-broctl-netstats/2711 "2013-06-25T17:50:02Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Derek\_Banks](https://avatars.discourse-cdn.com/v4/letter/d/45deac/32.png) [@Derek\_Banks](https://community.zeek.org/u/Derek_Banks)\ **Post date:** [June 25, 2013, 5:50pm UTC](https://community.zeek.org/t/question-about-capture-loss-script-vs-broctl-netstats/2711/1 "2013-06-25T17:50:02Z")
I apologize if this has been answered already - I was searching through the list archives and did’t seem to find the answer. I have configured a RHEL 6 server with the latest Bro from the repository and pf\_ring 5.2.2. It seems pf\_ring works - I run pfcount on my capture interface and it sees traffic and reports no packet loss. I have Bro configured per the post at [http://ossectools.blogspot.com/2011/09/bro-quickstart-cluster-edition.html](http://ossectools.blogspot.com/2011/09/bro-quickstart-cluster-edition.html) and everything starts fine and Bro is up and running. I run netstats in the Broctl shell and get: worker-0-1: 1372179895.260001 recvd=64969350 dropped=0 link=64969350 worker-0-2: 1372179895.461289 recvd=66422051 dropped=0 link=66422051 worker-0-3: 1372179895.660990 recvd=64099315 dropped=0 link=64099315 worker-0-4: 1372179895.861853 recvd=61738222 dropped=0 link=61738222 But in the notice.log file I see: 1372179930.880560 - - - - - - CaptureLoss::Too\_Much\_Loss The capture loss script detected an estimated loss rate above 38.520% - - - - - worker-0-3 Notice::ACTION\_LOG 3600.000000 F - - - – 1372179930.908354 - - - - - - CaptureLoss::Too\_Much\_Loss The capture loss script detected an estimated loss rate above 37.415% - - - - - worker-0-4 Notice::ACTION\_LOG 3600.000000 F - - - – 1372179930.923939 - - - - - - CaptureLoss::Too\_Much\_Loss The capture loss script detected an estimated loss rate above 40.462% - - - - - worker-0-1 Notice::ACTION\_LOG 3600.000000 F - - - – 1372179930.923939 - - - - - - CaptureLoss::Too\_Much\_Loss The capture loss script detected an estimated loss rate above 42.910% - - - - - worker-0-2 Notice::ACTION\_LOG 3600.000000 F - - - – So my question is, am I dropping packets or am I good to go? Best Regards, Derek Banks ---
**Author:** ![Schoenefeld\_Keith\_P](https://avatars.discourse-cdn.com/v4/letter/s/a183cd/32.png) [@Schoenefeld\_Keith\_P](https://community.zeek.org/u/Schoenefeld_Keith_P)\ **Post date:** [June 25, 2013, 6:15pm UTC](https://community.zeek.org/t/question-about-capture-loss-script-vs-broctl-netstats/2711/2 "2013-06-25T18:15:27Z")
My understanding is that this indicates Bro is processing every packet it receives, but it is only receiving about 60% of the packets that are crossing the wire Bro is monitoring… Do you have more information about the link you are tapping (bandwidth, packets/sec), the network card on the Bro box, and the specs of the Bro box? -- KS ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [June 25, 2013, 8:13pm UTC](https://community.zeek.org/t/question-about-capture-loss-script-vs-broctl-netstats/2711/3 "2013-06-25T20:13:26Z")
How are you tapping your traffic?   .Seth ---
**Author:** ![Derek\_Banks](https://avatars.discourse-cdn.com/v4/letter/d/45deac/32.png) [@Derek\_Banks](https://community.zeek.org/u/Derek_Banks)\ **Post date:** [June 25, 2013, 8:51pm UTC](https://community.zeek.org/t/question-about-capture-loss-script-vs-broctl-netstats/2711/4 "2013-06-25T20:51:43Z")
It is from a span fed into a Netoptics port regenerator that feeds a few devices. One of those is another Red Hat box with an Endace card in it. That box (and another device we have) do not seem to be dropping traffic. -Derek ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [June 26, 2013, 2:22am UTC](https://community.zeek.org/t/question-about-capture-loss-script-vs-broctl-netstats/2711/5 "2013-06-26T02:22:21Z")
How are you measuring packet loss with your other tools? The script that is generating those notices you saw is measuring aspects of TCP that indicate packet loss which could be happening upstream of your monitoring. By that, I mean you could be oversubscribing your SPAN port. It could be worth checking packet stats on the SPAN port to see if you are losing traffic there.   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/question-about-capture-loss-script-vs-broctl-netstats/2711/6 "2022-05-06T15:41:02Z")