WJH Events Reference
This reference lists all the NetQ-supported What Just Happened (WJH) metrics and provides a brief description of each. The full outputs vary slightly based on the type of drop and whether you are viewing the results in the NetQ UI or through one of the NetQ CLI commands.
For instructions on how to configure and monitor What Just Happened events, refer to Configure and Monitor What Just Happened.
Layer 1 Drops
Describes why a port is in the down state.
| Reason | Description |
|---|---|
| Auto-negotiation failure | Negotiation of port speed with peer has failed |
| Logical mismatch with peer link | Logical mismatch with peer link |
| Link training failure | Link is not able to go operational up due to link training failure |
| Peer is sending remote faults | Peer node is not operating correctly |
| Bad signal integrity | Integrity of the signal on port is not sufficient for good communication |
| Cable/transceiver is not supported | The attached cable or transceiver is not supported by this port |
| Cable/transceiver is unplugged | A cable or transceiver is missing or not fully inserted into the port |
| Calibration failure | Calibration failure |
| Port state changes counter | Cumulative number of state changes |
| Symbol error counter | Cumulative number of symbol errors |
| CRC error counter | Cumulative number of CRC errors |
In addition to the reason, the information provided for these drops includes:
| Parameter | Description |
|---|---|
| Corrective Action | Provides recommend actions to take to resolve the port down state |
| First Timestamp | Date and time this port was marked as down for the first time |
| Ingress Port | Port accepting incoming traffic |
| CRC Error Count | Number of CRC errors generated by this port |
| Symbol Error Count | Number of Symbol errors generated by this port |
| State Change Count | Number of state changes that have occurred on this port |
| OPID | Operation identifier; used for internal purposes |
| Is Port Up | Indicates whether the port is in an Up (true) or Down (false) state |
Layer 2 Drops
Describes why a link is down.
| Reason | Severity | Description |
|---|---|---|
| MLAG port isolation | Notice | Not supported for port isolation implemented with system ACL |
| Destination MAC is reserved (DMAC=01-80-C2-00-00-0x) | Error | The address cannot be used by this link |
| VLAN tagging mismatch | Error | VLAN tags on the source and destination do not match |
| Ingress VLAN filtering | Error | Frames whose port is not a member of the VLAN are discarded |
| Ingress spanning tree filter | Notice | Port is in Spanning Tree blocking state |
| Unicast MAC table action discard | Notice | Packet dropped due to a MAC table configuration rule |
| Multicast egress port list is empty | Warning | No ports are defined for multicast egress |
| Port loopback filter | Error | Port is operating in loopback mode; packets are being sent to itself (source MAC address is the same as the destination MAC address) |
| Source MAC is multicast | Error | Packets have multicast source MAC address |
| Source MAC equals destination MAC | Error | Source MAC address is the same as the destination MAC address |
In addition to the reason, the information provided for these drops includes:
| Parameter | Description |
|---|---|
| Source Port | Port ID where the link originates |
| Source IP | Port IP address where the link originates |
| Source MAC | Port MAC address where the link originates |
| Destination Port | Port ID where the link terminates |
| Destination IP | Port IP address where the link terminates |
| Destination MAC | Port MAC address where the link terminates |
| First Timestamp | Date and time this link was marked as down for the first time |
| Aggregate Count | Total number of dropped packets |
| Protocol | ID of the communication protocol running on this link |
| Ingress Port | Port accepting incoming traffic |
| OPID | Operation identifier; used for internal purposes |
Router Drops
Describes why the server is unable to route a packet.
| Reason | Severity | Description |
|---|---|---|
| Non-routable packet | Notice | Packet has no route in routing table |
| Blackhole route | Warning | Packet received with action equal to discard |
| Unresolved next hop | Warning | The next hop in the route is unknown |
| Blackhole ARP/neighbor | Warning | Packet received with blackhole adjacency |
| IPv6 destination in multicast scope FFx0:/16 | Notice | Packet received with multicast destination address in FFx0:/16 address range |
| IPv6 destination in multicast scope FFx1:/16 | Notice | Packet received with multicast destination address in FFx1:/16 address range |
| Non-IP packet | Notice | Cannot read packet header because it is not an IP packet |
| Unicast destination IP but non-unicast destination MAC | Error | Cannot read packet with IP unicast address when destination MAC address is not unicast (FF:FF:FF:FF:FF:FF) |
| Destination IP is loopback address | Error | Cannot read packet as destination IP address is a loopback address (dip=>127.0.0.0/8) |
| Source IP is multicast | Error | Cannot read packet as source IP address is a multicast address (ipv4 SIP => 224.0.0.0/4) |
| Source IP is in class E | Error | Cannot read packet as source IP address is a Class E address |
| Source IP is loopback address | Error | Cannot read packet as source IP address is a loopback address (ipv4 => 127.0.0.0/8 for ipv6 => ::1/128) |
| Source IP is unspecified | Error | Cannot read packet as source IP address is unspecified (ipv4 = 0.0.0.0/32; for ipv6 = ::0) |
| Checksum or IP ver or IPv4 IHL too short | Error | Cannot read packet due to header checksum error, IP version mismatch, or IPv4 header length is too short |
| Multicast MAC mismatch | Error | For IPv4, destination MAC address is not equal to {0x01-00-5E-0 (25 bits), DIP[22:0]} and DIP is multicast. For IPv6, destination MAC address is not equal to {0x3333, DIP[31:0]} and DIP is multicast |
| Source IP equals destination IP | Error | Packet has a source IP address equal to the destination IP address |
| IPv4 source IP is limited broadcast | Error | Packet has broadcast source IP address |
| IPv4 destination IP is local network (destination = 0.0.0.0/8) | Error | Packet has IPv4 destination address that is a local network (destination=0.0.0.0/8) |
| IPv4 destination IP is link-local (destination in 169.254.0.0/16) | Error | Packet has IPv4 destination address that is a local link |
| Ingress router interface is disabled | Warning | Packet destined to a different subnet cannot be routed because ingress router interface is disabled |
| Egress router interface is disabled | Warning | Packet destined to a different subnet cannot be routed because egress router interface is disabled |
| IPv4 routing table (LPM) unicast miss | Warning | No route available in routing table for packet |
| IPv6 routing table (LPM) unicast miss | Warning | No route available in routing table for packet |
| Router interface loopback | Warning | Packet has destination IP address that is local. For example, SIP = 1.1.1.1, DIP = 1.1.1.128. |
| Packet size is larger than MTU | Warning | Packet has larger MTU configured than the VLAN |
| TTL value is too small | Warning | Packet has TTL value of 1 |
Tunnel Drops
Describes why a tunnel is down.
| Reason | Severity | Description |
|---|---|---|
| Overlay switch - source MAC is multicast | Error | Overlay packet’s source MAC address is multicast |
| Overlay switch - source MAC equals destination MAC | Error | Overlay packet’s source MAC address is the same as the destination MAC address |
| Decapsulation error | Error | De-capsulation produced incorrect format of packet. For example, encapsulation of packet with many VLANs or IP options on the underlay can cause de-capsulation to result in a short packet. |
| Tunnel interface is disabled | Error | Packet cannot de-capsulate because the tunnel interface is disabled |
Buffer Drops
Describes why the server buffer has dropped packets.
| Reason | Severity | Description |
|---|---|---|
| Tail drop | Warning | Tail drop is enabled, and buffer queue is filled to maximum capacity |
| WRED | Warning | Weighted Random Early Detection is enabled, and buffer queue is filled to maximum capacity or the RED engine dropped the packet as of random congestion prevention |
| Port TC Congestion Threshold Crossed | Warning | Percentage of the occupancy buffer exceeded or dropped below the specified high or low threshold |
| Packet Latency Threshold Crossed | Warning | Time a packet spent within the switch exceeded or dropped below the specified high or low threshold |
ACL Drops
Describes why an ACL has dropped packets.
| Reason | Severity | Description |
|---|---|---|
| Ingress port ACL | Notice | ACL action set to deny on the physical ingress port or bond |
| Ingress router ACL | Notice | ACL action set to deny on the ingress switch virtual interfaces (SVIs) |
| Egress port ACL | Notice | ACL action set to deny on the physical egress port or bond |
| Egress router ACL | Notice | ACL action set to deny on the egress SVIs |