WJH Events Reference

This reference lists all the NetQ-supported What Just Happened (WJH) metrics and provides a brief description of each. The full outputs vary slightly based on the type of drop and whether you are viewing the results in the NetQ UI or through one of the NetQ CLI commands.

For instructions on how to configure and monitor What Just Happened events, refer to Configure and Monitor What Just Happened.

Layer 1 Drops

Describes why a port is in the down state.

ReasonDescription
Auto-negotiation failureNegotiation of port speed with peer has failed
Logical mismatch with peer linkLogical mismatch with peer link
Link training failureLink is not able to go operational up due to link training failure
Peer is sending remote faultsPeer node is not operating correctly
Bad signal integrityIntegrity of the signal on port is not sufficient for good communication
Cable/transceiver is not supportedThe attached cable or transceiver is not supported by this port
Cable/transceiver is unpluggedA cable or transceiver is missing or not fully inserted into the port
Calibration failureCalibration failure
Port state changes counterCumulative number of state changes
Symbol error counterCumulative number of symbol errors
CRC error counterCumulative number of CRC errors

In addition to the reason, the information provided for these drops includes:

ParameterDescription
Corrective ActionProvides recommend actions to take to resolve the port down state
First TimestampDate and time this port was marked as down for the first time
Ingress PortPort accepting incoming traffic
CRC Error CountNumber of CRC errors generated by this port
Symbol Error CountNumber of Symbol errors generated by this port
State Change CountNumber of state changes that have occurred on this port
OPIDOperation identifier; used for internal purposes
Is Port UpIndicates whether the port is in an Up (true) or Down (false) state

Layer 2 Drops

Describes why a link is down.

ReasonSeverityDescription
MLAG port isolationNoticeNot supported for port isolation implemented with system ACL
Destination MAC is reserved (DMAC=01-80-C2-00-00-0x)ErrorThe address cannot be used by this link
VLAN tagging mismatchErrorVLAN tags on the source and destination do not match
Ingress VLAN filteringErrorFrames whose port is not a member of the VLAN are discarded
Ingress spanning tree filterNoticePort is in Spanning Tree blocking state
Unicast MAC table action discardNoticePacket dropped due to a MAC table configuration rule
Multicast egress port list is emptyWarningNo ports are defined for multicast egress
Port loopback filterErrorPort is operating in loopback mode; packets are being sent to itself (source MAC address is the same as the destination MAC address)
Source MAC is multicastErrorPackets have multicast source MAC address
Source MAC equals destination MACErrorSource MAC address is the same as the destination MAC address

In addition to the reason, the information provided for these drops includes:

ParameterDescription
Source PortPort ID where the link originates
Source IPPort IP address where the link originates
Source MACPort MAC address where the link originates
Destination PortPort ID where the link terminates
Destination IPPort IP address where the link terminates
Destination MACPort MAC address where the link terminates
First TimestampDate and time this link was marked as down for the first time
Aggregate CountTotal number of dropped packets
ProtocolID of the communication protocol running on this link
Ingress PortPort accepting incoming traffic
OPIDOperation identifier; used for internal purposes

Router Drops

Describes why the server is unable to route a packet.

ReasonSeverityDescription
Non-routable packetNoticePacket has no route in routing table
Blackhole routeWarningPacket received with action equal to discard
Unresolved next hopWarningThe next hop in the route is unknown
Blackhole ARP/neighborWarningPacket received with blackhole adjacency
IPv6 destination in multicast scope FFx0:/16NoticePacket received with multicast destination address in FFx0:/16 address range
IPv6 destination in multicast scope FFx1:/16NoticePacket received with multicast destination address in FFx1:/16 address range
Non-IP packetNoticeCannot read packet header because it is not an IP packet
Unicast destination IP but non-unicast destination MACErrorCannot read packet with IP unicast address when destination MAC address is not unicast (FF:FF:FF:FF:FF:FF)
Destination IP is loopback addressErrorCannot read packet as destination IP address is a loopback address (dip=>127.0.0.0/8)
Source IP is multicastErrorCannot read packet as source IP address is a multicast address (ipv4 SIP => 224.0.0.0/4)
Source IP is in class EErrorCannot read packet as source IP address is a Class E address
Source IP is loopback addressErrorCannot read packet as source IP address is a loopback address (ipv4 => 127.0.0.0/8 for ipv6 => ::1/128)
Source IP is unspecifiedErrorCannot read packet as source IP address is unspecified (ipv4 = 0.0.0.0/32; for ipv6 = ::0)
Checksum or IP ver or IPv4 IHL too shortErrorCannot read packet due to header checksum error, IP version mismatch, or IPv4 header length is too short
Multicast MAC mismatchErrorFor IPv4, destination MAC address is not equal to {0x01-00-5E-0 (25 bits), DIP[22:0]} and DIP is multicast. For IPv6, destination MAC address is not equal to {0x3333, DIP[31:0]} and DIP is multicast
Source IP equals destination IPErrorPacket has a source IP address equal to the destination IP address
IPv4 source IP is limited broadcastErrorPacket has broadcast source IP address
IPv4 destination IP is local network (destination = 0.0.0.0/8)ErrorPacket has IPv4 destination address that is a local network (destination=0.0.0.0/8)
IPv4 destination IP is link-local (destination in 169.254.0.0/16)ErrorPacket has IPv4 destination address that is a local link
Ingress router interface is disabledWarningPacket destined to a different subnet cannot be routed because ingress router interface is disabled
Egress router interface is disabledWarningPacket destined to a different subnet cannot be routed because egress router interface is disabled
IPv4 routing table (LPM) unicast missWarningNo route available in routing table for packet
IPv6 routing table (LPM) unicast missWarningNo route available in routing table for packet
Router interface loopbackWarningPacket has destination IP address that is local. For example, SIP = 1.1.1.1, DIP = 1.1.1.128.
Packet size is larger than MTUWarningPacket has larger MTU configured than the VLAN
TTL value is too smallWarningPacket has TTL value of 1

Tunnel Drops

Describes why a tunnel is down.

ReasonSeverityDescription
Overlay switch - source MAC is multicastErrorOverlay packet’s source MAC address is multicast
Overlay switch - source MAC equals destination MACErrorOverlay packet’s source MAC address is the same as the destination MAC address
Decapsulation errorErrorDe-capsulation produced incorrect format of packet. For example, encapsulation of packet with many VLANs or IP options on the underlay can cause de-capsulation to result in a short packet.
Tunnel interface is disabledErrorPacket cannot de-capsulate because the tunnel interface is disabled

Buffer Drops

Describes why the server buffer has dropped packets.

ReasonSeverityDescription
Tail dropWarningTail drop is enabled, and buffer queue is filled to maximum capacity
WREDWarningWeighted Random Early Detection is enabled, and buffer queue is filled to maximum capacity or the RED engine dropped the packet as of random congestion prevention
Port TC Congestion Threshold CrossedWarningPercentage of the occupancy buffer exceeded or dropped below the specified high or low threshold
Packet Latency Threshold CrossedWarningTime a packet spent within the switch exceeded or dropped below the specified high or low threshold

ACL Drops

Describes why an ACL has dropped packets.

ReasonSeverityDescription
Ingress port ACLNoticeACL action set to deny on the physical ingress port or bond
Ingress router ACLNoticeACL action set to deny on the ingress switch virtual interfaces (SVIs)
Egress port ACLNoticeACL action set to deny on the physical egress port or bond
Egress router ACLNoticeACL action set to deny on the egress SVIs