The details shown below are based on the default settings. When editing this alert, you can change the trigger and clear conditions to suit your needs. However, you can’t edit the time period in the trigger or clear conditions.
Primary purpose: Notify when the packet discards for a device are greater than the defined thresholds.
Possible causes for this alert include:
- Network congestion
- Interface receiving tagged traffic for a VLAN it’s not configured to use
- Spanning tree with blocked port
- Faulty hardware
- Port authentication or port-security violations
- Frames exceeding storm control limits
- All zero MAC addresses for either the source or the destination
- MAC address of source and destination are equal
- ARP requests with all zeros for the IP address
- Hardware ACL dropping traffic
- Hardware queue on the interface is full (overbooking)
- Software buffer is full (CPU doesn’t have enough resources to process traffic)
- Multi-path fading (if device is an access point or wireless)
|
Alert severity |
Warning |
|
Repetitive alert pause condition |
After 5 occurrences within 2 hours against a specific entity, pause the alert for 24 hours |
|
Alert trigger condition |
The number of packet discards on a device has gone above the defined threshold over a period of five minutes. |
|
Alert clear condition |
The number of packet discards is less than or equal to the defined thresholds over a period of five minutes. |
|
Action(s) to be taken |
Check the device to see what could be causing excessive packet discards. |