# Network Interface Drops **URL:** \ **Category:** Help\ **Tags:** agent\ **Created:** [April 17, 2021, 10:41am UTC](https://community.netdata.cloud/t/network-interface-drops/1196 "2021-04-17T10:41:53Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![AiurAL](https://avatars.discourse-cdn.com/v4/letter/a/df705f/32.png) [@AiurAL](https://community.netdata.cloud/u/AiurAL)\ **Post date:** [April 17, 2021, 10:41am UTC](https://community.netdata.cloud/t/network-interface-drops/1196/1 "2021-04-17T10:41:53Z")
Hi, The following graph is the network interface drops of my instance, and I am a little bit confused about it. Why this graph is so similar to the graph of sine? Also, the average drops is always very close to 0.5 drops per 5 seconds, which is a little unusual. How can I know what is going on here? ![image](https://canada1.discourse-cdn.com/flex029/uploads/netdata2/original/1X/44c91ea13b466065673ffec2939fab8be761a366.png) ---
**Author:** ![OdysLam](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/odyslam/32/98_2.png) [@OdysLam](https://community.netdata.cloud/u/OdysLam)\ **Post date:** [April 19, 2021, 12:05pm UTC](https://community.netdata.cloud/t/network-interface-drops/1196/2 "2021-04-19T12:05:28Z")
Hey @AiurAL and welcome to our community! @ilyam8 do you have any idea? 😛 ---
**Author:** ![ilyam8](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/ilyam8/32/134_2.png) [@ilyam8](https://community.netdata.cloud/u/ilyam8)\ **Post date:** [April 19, 2021, 12:26pm UTC](https://community.netdata.cloud/t/network-interface-drops/1196/3 "2021-04-19T12:26:22Z")
Hi @AiurAL The question is about the pattern (_close to 0.5 drops per 5 seconds_) or how to debug these drops/identify dropped packets? ---
**Author:** ![AiurAL](https://avatars.discourse-cdn.com/v4/letter/a/df705f/32.png) [@AiurAL](https://community.netdata.cloud/u/AiurAL)\ **Post date:** [April 19, 2021, 12:52pm UTC](https://community.netdata.cloud/t/network-interface-drops/1196/4 "2021-04-19T12:52:24Z")
Thank you for your reply! I am curious about both the pattern and ways to debug the dropped packets. ---
**Author:** ![ilyam8](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/ilyam8/32/134_2.png) [@ilyam8](https://community.netdata.cloud/u/ilyam8)\ **Post date:** [April 19, 2021, 6:15pm UTC](https://community.netdata.cloud/t/network-interface-drops/1196/5 "2021-04-19T18:15:54Z")
Did you use [tcpdump](https://www.tcpdump.org/tcpdump_man.html)? You use it capture and analyze network traffic. Keep in mind then there [won’t be any dropds during capturing](https://community.netdata.cloud/t/dropped-packets/495/2). ---
**Author:** ![AiurAL](https://avatars.discourse-cdn.com/v4/letter/a/df705f/32.png) [@AiurAL](https://community.netdata.cloud/u/AiurAL)\ **Post date:** [April 20, 2021, 7:57am UTC](https://community.netdata.cloud/t/network-interface-drops/1196/6 "2021-04-20T07:57:30Z")
I tried it. It shown the count of dropped packets but did not provide any information about the dropped packets. ---
**Author:** ![ilyam8](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/ilyam8/32/134_2.png) [@ilyam8](https://community.netdata.cloud/u/ilyam8)\ **Post date:** [April 21, 2021, 8:00pm UTC](https://community.netdata.cloud/t/network-interface-drops/1196/7 "2021-04-21T20:00:58Z")
Yes, it doesn’t report info about drops, it captures all the packets (assuming no filtering applied) and you can analyze them in real-time or export the capture and analyze using [wireshark](https://www.wireshark.org/). There could be a lot of reasons, for instance: - switch port configured as trunk and your server receives tagged traffic ([VLAN](https://en.wikipedia.org/wiki/Virtual_LAN)) - there is some device (or devices) in your network that sends multicast packets (likely IPv6) Check `Interface Drops (net_drops.ens160)` chart when using tcpdump (make sure capture on ens160 - `sudo tcpdump -n -i ens160`). I guess there would be 0 drops? ---
**Author:** ![AiurAL](https://avatars.discourse-cdn.com/v4/letter/a/df705f/32.png) [@AiurAL](https://community.netdata.cloud/u/AiurAL)\ **Post date:** [April 22, 2021, 8:46am UTC](https://community.netdata.cloud/t/network-interface-drops/1196/8 "2021-04-22T08:46:43Z")
Thank you for your interpretation. Now I can capture packets correctly and found the pattern that one stp packet is received each 2 seconds, which fits the packet drops shown in the graph (0.5 drops/s). Seems that the dropped packets are stp packets, but how can I prove it? (e.g. What causes stp packets dropped?) ---
**Author:** ![ilyam8](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/ilyam8/32/134_2.png) [@ilyam8](https://community.netdata.cloud/u/ilyam8)\ **Post date:** [April 24, 2021, 9:00pm UTC](https://community.netdata.cloud/t/network-interface-drops/1196/9 "2021-04-24T21:00:10Z")
@AiurAL It falls into the unregistered protocols drops category. You need to configure **hosts-facing ports** as edge (D-Link, Cisco switches) ports on your switch (do not send STP packets). Check the documentation for your network device. ---
**Author:** ![AiurAL](https://avatars.discourse-cdn.com/v4/letter/a/df705f/32.png) [@AiurAL](https://community.netdata.cloud/u/AiurAL)\ **Post date:** [April 25, 2021, 2:34am UTC](https://community.netdata.cloud/t/network-interface-drops/1196/10 "2021-04-25T02:34:39Z")
It is a little bit difficult for me to configure the switch. Could we solve this problem by configuring our machine? I noticed that you mentioned “unregistered protocols drops category”. Could we find and configure it in Linux? ---
**Author:** ![ilyam8](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/ilyam8/32/134_2.png) [@ilyam8](https://community.netdata.cloud/u/ilyam8)\ **Post date:** [April 25, 2021, 7:50am UTC](https://community.netdata.cloud/t/network-interface-drops/1196/11 "2021-04-25T07:50:49Z")
I would say don’t treat it as a problem. Dropped packets are just dropped packets. > I noticed that you mentioned “unregistered protocols drops category”. Yes, anything not expected by your sever is being dropped (STP frames in your case).