# Question about capture loss script vs. broctl netstats **URL:** \ **Category:** Zeek\ **Created:** [June 25, 2013, 6:07pm UTC](https://community.zeek.org/t/question-about-capture-loss-script-vs-broctl-netstats/2712 "2013-06-25T18:07:05Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Derek\_Banks](https://avatars.discourse-cdn.com/v4/letter/d/45deac/32.png) [@Derek\_Banks](https://community.zeek.org/u/Derek_Banks)\ **Post date:** [June 25, 2013, 6:07pm UTC](https://community.zeek.org/t/question-about-capture-loss-script-vs-broctl-netstats/2712/1 "2013-06-25T18:07:05Z")
![](https://mail.google.com/mail/u/0/images/cleardot.gif) I apologize if this has been answered already - I was searching through the list archives and did’t seem to find the answer. I have configured a RHEL 6 server with the latest Bro from the repository and pf\_ring 5.2.2. It seems pf\_ring works - I run pfcount on my capture interface and it sees traffic and reports no packet loss. I have Bro configured per the post at [http://ossectools.blogspot.com/2011/09/bro-quickstart-cluster-edition.html](http://ossectools.blogspot.com/2011/09/bro-quickstart-cluster-edition.html) and everything starts fine and Bro is up and running. I run netstats in the Broctl shell and get: worker-0-1: 1372179895.260001 recvd=64969350 dropped=0 link=64969350 worker-0-2: 1372179895.461289 recvd=66422051 dropped=0 link=66422051 worker-0-3: 1372179895.660990 recvd=64099315 dropped=0 link=64099315 worker-0-4: 1372179895.861853 recvd=61738222 dropped=0 link=61738222 But in the notice.log file I see: 1372179930.880560 - - - - - - CaptureLoss::Too\_Much\_Loss The capture loss script detected an estimated loss rate above 38.520% - - - - - worker-0-3 Notice::ACTION\_LOG 3600.000000 F - - - – 1372179930.908354 - - - - - - CaptureLoss::Too\_Much\_Loss The capture loss script detected an estimated loss rate above 37.415% - - - - - worker-0-4 Notice::ACTION\_LOG 3600.000000 F - - - – 1372179930.923939 - - - - - - CaptureLoss::Too\_Much\_Loss The capture loss script detected an estimated loss rate above 40.462% - - - - - worker-0-1 Notice::ACTION\_LOG 3600.000000 F - - - – 1372179930.923939 - - - - - - CaptureLoss::Too\_Much\_Loss The capture loss script detected an estimated loss rate above 42.910% - - - - - worker-0-2 Notice::ACTION\_LOG 3600.000000 F - - - – So my question is, am I dropping packets or am I good to go? Best Regards, Derek Banks ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [June 27, 2013, 1:09pm UTC](https://community.zeek.org/t/question-about-capture-loss-script-vs-broctl-netstats/2712/2 "2013-06-27T13:09:08Z")
As seth mentions, the capture-loss script is quite robust, because it essentially computes an end-to-end value. I don't know of any situations where in practice it makes poor estimates. These stats: > worker-0-1: 1372179895.260001 recvd=64969350 dropped=0 link=64969350 > worker-0-2: 1372179895.461289 recvd=66422051 dropped=0 link=66422051 > worker-0-3: 1372179895.660990 recvd=64099315 dropped=0 link=64099315 > worker-0-4: 1372179895.861853 recvd=61738222 dropped=0 link=61738222 on the other hand come from the kernel's statistics. If packets are lost prior to the kernel even seeing them (such as due to an overwhelmed SPAN port - quite common), then while it reports no drops, that's not a useful end-to-end measure. (Also, some kernels have bugs in how these statistics are captured, for example missing out on packets dropped by the NIC rather than the kernel.)     Vern ---
**Author:** ![Alex\_Waher](https://avatars.discourse-cdn.com/v4/letter/a/8e7dd6/32.png) [@Alex\_Waher](https://community.zeek.org/u/Alex_Waher)\ **Post date:** [June 27, 2013, 6:00pm UTC](https://community.zeek.org/t/question-about-capture-loss-script-vs-broctl-netstats/2712/3 "2013-06-27T18:00:53Z")
If you’re seeing nearly 50% of dropped traffic, perhaps the SPAN session is monitoring one direction of traffic flow across a NAT’d interface or proxy server? On the external interface monitoring inbound, and on the internal interface monitoring inbound? Any introduction of non bi-directional traffic would very likely confuse the capture loss script. ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [June 27, 2013, 6:17pm UTC](https://community.zeek.org/t/question-about-capture-loss-script-vs-broctl-netstats/2712/4 "2013-06-27T18:17:10Z")
Since you're using a DAG card this could depend on what sort of flow splitting configuration you have in place there too.   .Seth ---
**Author:** ![Derek\_Banks](https://avatars.discourse-cdn.com/v4/letter/d/45deac/32.png) [@Derek\_Banks](https://community.zeek.org/u/Derek_Banks)\ **Post date:** [June 27, 2013, 6:21pm UTC](https://community.zeek.org/t/question-about-capture-loss-script-vs-broctl-netstats/2712/5 "2013-06-27T18:21:34Z")
Thanks for all the responses. I put an Intel Pro 1000 in this morning and still using PF\_Ring. I three hours of running Bro, I don’t see any reported packet loss. Looks like the Broadcom Card was most likely the problem. -Derek ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [June 27, 2013, 6:38pm UTC](https://community.zeek.org/t/question-about-capture-loss-script-vs-broctl-netstats/2712/6 "2013-06-27T18:38:12Z")
Oh yeah, I would never use Broadcom for sniffing. I've had way too many problems with them.   .Seth ---
**Author:** ![Michal\_Purzynski](https://avatars.discourse-cdn.com/v4/letter/m/f19dbf/32.png) [@Michal\_Purzynski](https://community.zeek.org/u/Michal_Purzynski)\ **Post date:** [June 27, 2013, 9:15pm UTC](https://community.zeek.org/t/question-about-capture-loss-script-vs-broctl-netstats/2712/7 "2013-06-27T21:15:17Z")
> > Thanks for all the responses. I put an Intel Pro 1000 in this morning and still using PF\_Ring. I three hours of running Bro, I don't see any reported packet loss. Looks like the Broadcom Card was most likely the problem. > > Oh yeah, I would never use Broadcom for sniffing. I've had way too many problems with them. Use Intel or ... use Intel. Too many stability problems with other vendors, and all of them resolved using X520. Unless you can afford DAG or similar of course. ---
**Author:** ![dataolle](https://avatars.discourse-cdn.com/v4/letter/d/53a042/32.png) [@dataolle](https://community.zeek.org/u/dataolle)\ **Post date:** [June 30, 2013, 10:25pm UTC](https://community.zeek.org/t/question-about-capture-loss-script-vs-broctl-netstats/2712/8 "2013-06-30T22:25:47Z")
myrinet seems to be pretty popular aswell, so i would guess work ok aswell, or? //Kristoffer ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [July 1, 2013, 2:50pm UTC](https://community.zeek.org/t/question-about-capture-loss-script-vs-broctl-netstats/2712/9 "2013-07-01T14:50:24Z")
Yep, for people with 10G links they're monitoring I'd almost always go with Myricom with the sniffer drivers. They have commodity pricing on their NICs and they do the hash based load balancing and it's extremely easy to setup (and it works on freebsd and linux).   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/question-about-capture-loss-script-vs-broctl-netstats/2712/10 "2022-05-06T15:41:03Z")