This is what I'm seeing:# netstat -iKernel Interface tableIface       MTU Met    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flgbond0      1500   0   703449      0 147463      0   978099      0      0      0 BMmRUeth4       1500   0   306302      0      0      0   259244      0      0      0 BMsRUeth5       1500   0   397147      0      6      0   718855      0      0      0 BMsRUlo        16436   0  1977704      0      0      0  1977704      0      0      0 LRU# cat /proc/net/bonding/bond0Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)Bonding Mode: IEEE 802.3ad Dynamic link aggregationTransmit Hash Policy: layer3+4 (1)MII Status: upMII Polling Interval (ms): 100Up Delay (ms): 5000Down Delay (ms): 5000802.3ad infoLACP rate: fastAggregator selection policy (ad_select): stableActive Aggregator Info:       Aggregator ID: 1       Number of ports: 2       Actor Key: 17       Partner Key: 32912       Partner Mac Address: RE:DA:CT:ED:be:05Slave Interface: eth4MII Status: upSpeed: 1000 MbpsDuplex: fullLink Failure Count: 0Permanent HW addr: RE:DA:CT:ED:1a:daAggregator ID: 1Slave queue ID: 0Slave Interface: eth5MII Status: upSpeed: 1000 MbpsDuplex: fullLink Failure Count: 0Permanent HW addr: RE:DA:CT:ED:1a:dbAggregator ID: 1Slave queue ID: 021% packet drop amounts to a DOS attack. (I'm not far enough along in my investigation to have an opinion on deliberate and/or malicious.) The bond is comprised of eth4 and eth5. No other interfaces are active on the host.What this is not:No firewall is running on this host. This isn't packet drop due to an internal firewall.cat /proc/net/bonding/bond0 shows no errorsethtool -S <iface> shows no errors, but only has results for the individual interfaces; nothing on the bond as a whole.The Networking team says the switch is matching this host's IP address with the bond MAC address, and both values are correct.Limitations:The network is run by a different team. I have no direct access to the switches.Questions:What would cause the bond to drop packets?Why is the bond showing packet drop, but not the individual interfaces?What Cisco switch suggestions can I pass back to the Networking team to help narrow this down?If I start a tcpdump on the bond, would it see the packets getting dropped, or does the drop happen before the point where tcpdump do its recording?I found a reference to dropwatch, and installed and ran it. The only drops are of the form0 drops at irq_stack_union+0-1 drops at __per_cpu_end+fffee201-1 drops at __per_cpu_end+fffee202Looking into that, now.irqbalance shows a whole bunch of information, none of which is a slam dunk. But, the daemon is running on the host.This Red Hat solution mentions Softnet Backup Full. Other solutions add measured in /proc/net/softnet_stat. None of the solutions so far goes into detail on what that means. How do I specifically identify that Softnet Backup Full is or is not the source of these packet drops?
Oracle Linux 5: 21% received packet drop
ethernet;tcp;oracle linux