Drop packet mismatch

[WPTechnician]

Version

2.4.40

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

32

RAM

144GB

Storage for /

200GB

Storage for /nsm

5T

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi! I am seeing a strange discrepancy between "Dropped Monitor Traffic" in the Grid:

...and the "Monitor Interface Drops - Inbound":

The throughput it is reporting is quite low:

I can't find anything in the documentation specific to this scenario. This started when I installed an updated server with 2.4. I didn't see this at all with the older server and 2.3. No other changes have happened. Thanks!

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[reyesj2]

What do those two graphs show when you set the time to be greater than 30 minutes? Try a 3 hour window

[WPTechnician]

Hi:

Here is the three hour window:

Traffic inbound:

Monitor Interface Drops Inbound:

Thanks!