Check flow sequence numbers to detect missing packets

Description

Currently, there is no reliable way to detect if flow packets get dropped because the listeners don't pick up packets fast enough from the receive queue. There is no good instrumentation available, neither by OpenNMS nor by the underlying OS.

By checking the flow sequence numbers we can, at least, detect missing flows due to buffer overruns or packet drops during transport.

Acceptance / Success Criteria

None

Lucidchart Diagrams

Activity

Show:

fooker November 30, 2020 at 10:41 AM

fooker November 26, 2020 at 11:00 PM

Benjamin Reed November 2, 2020 at 6:09 PM

Seems like at this point step 1 is to add some tracing to the process of enriching flows with DNS so we can figure out where the bottleneck is.  do you have familiarity with the tracing stuff to be able to do that?

Zoë Knox October 26, 2020 at 4:30 PM

With reverse DNS enabled:

With reverse DNS disabled:

Fixed

Details

Assignee

Reporter

Components

Sprint

Fix versions

Affects versions

Priority

PagerDuty

Created November 30, 2020 at 10:40 AM
Updated November 30, 2020 at 10:41 AM
Resolved November 30, 2020 at 10:41 AM