CaptureLoss::Too_Much_Loss

[marcRBD]

hello everyone

SO
Version: 2.3.110

so-status

checking Docker status

Docker ---------------------------------------------------------------------------------------------------------------------------- [ OK ]

Checking container statuses

so-aptcacherng -------------------------------------------------------------------------------------------------------------------- [ OK ]
so-dockerregistry ----------------------------------------------------------------------------------------------------------------- [ OK ]
so-elastalert --------------------------------------------------------------------------------------------------------------------- [ OK ]
so-elasticsearch ------------------------------------------------------------------------------------------------------------------ [ OK ]
so-filebeat ----------------------------------------------------------------------------------------------------------------------- [ OK ]
so-grafana ------------------------------------------------------------------------------------------------------------------------ [ OK ]
so-idstools ----------------------------------------------------------------------------------------------------------------------- [ OK ]
so-influxdb ----------------------------------------------------------------------------------------------------------------------- [ OK ]
so-kibana ------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-kratos ------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-logstash ----------------------------------------------------------------------------------------------------------------------- [ OK ]
so-mysql -------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-nginx -------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-playbook ----------------------------------------------------------------------------------------------------------------------- [ OK ]
so-redis -------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-sensoroni ---------------------------------------------------------------------------------------------------------------------- [ OK ]
so-soc ---------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-soctopus ----------------------------------------------------------------------------------------------------------------------- [ OK ]
so-telegraf ----------------------------------------------------------------------------------------------------------------------- [ OK ]
so-wazuh -------------------------------------------------------------------------------------------------------------------------- [ OK ]

when i filter , i got this message:

The capture loss script detected an estimated loss rate above 58.907%

Does there is an easy way to confirme there is a loss or not ?
is it a well know issue on vmware stack ?

thanks

[dougburks]

https://docs.securityonion.net/en/2.3/zeek.html#packet-loss-and-capture-loss