ASA5585-SSP-IPS40 Inspection Load 0 with Missed Packets at 50% or more

[krussell]

The IPS40 is showing missed packets yet the Inspection Load remains at 0.

Two questions.

1. What would cause Missed Packets and is there a "best" method to troubleshot the situation?

2. Why does the Inspection Load remain at 0?

vs0 is currently assigned to PortChannel0/0 (Backplane interface)

Thanks,

Kevin

[Julio Carvajal]

Hello Kevin,

Importan to let you know that for missed packets the IPS count packets being dropped byL2errors and oversupscription.

Based on the load being on 0 I would say it would make sense to think about L2 errors, is there a way you could doble check the layer 2 connectivity between them.

Regards,

[krussell]

The IPS and Firewall are connected through PortChannel0/0. Not sure how you can check L2 connectivity on a backplane connection. Any ideas?

[Julio Carvajal]

Hello Kevin,

What version are you running

Also share the following:

show stat virt

show int

Also over the show tech look the following :

exec: cat /proc/net/cisco/cids-shared.info

And let me know the free buffer percentage you see there

Regards,

Remember to rate all of the helpful posts

[krussell]

jcarvaja,

Attached is the information you requested. Let me know if you need anything else. Thanks for your help!

Kevin

[Julio Carvajal]

Hello Kevin,

On the show tech I do not see the missed packet percentage on 50 % or any other value than 0

Can you double check that please

[krussell]

jcarvaja,

Having just witnessed another indication form the Sensor Health gadget that packets were being missed, I again ran the commands you suggested with a result of 0 missed packets in the output. Is it possible the Sensor Health gadget is reporting false indications?

Thanks,

Kevin

[Kyle Bolton · Accepted solution]

Theres a known bug in 7.1.6 that causes this.

CSCud36621

Rebooting the sensor will fix it for a period of time. Fix is scheduled in 7.1.7