Description

What is the difference between normal discard and extended discard, as reported in the packet forwarding engine hardware discard statistics section of the show pfe statistics traffic output.

Solution

There are multiple types of packet discard statistics maintained in the Packet Forwarding Engine (PFE) as normal discard and extended discard:

user@host> show pfe statistics traffic    
[...]
Packet Forwarding Engine hardware discard statistics:
    Timeout                    :                    0
    Truncated key              :                    0   
    Bits to test               :                    0        
    Data error                 :                    0
    Stack underflow            :                    0
    Stack overflow             :                    0
    Normal discard              :                 3077
    Extended discard            :                  134
    Invalid interface          :                    0
    Info cell drops            :                    0
    Fabric drops               :                    0



The normal discard counter, in the show pfe statistics traffic output, reports the number of packets (notifications) that are silently discarded at packet forwarding engine level, without being further processed by the host (CPU on the System Board or on the Routing Engine).

For discarded packets the host (System Board) will not even need to originate an ICMP destination unreachable message toward the source of the packet, hence the packet is silently dropped.

Normal discard are reported when:
  1. Packets match a specific term of a firewall filter term with an action of discard
    user@host# show firewall
        filter discard {
            term discard {
                from {
                    source-address {
                        192.168.1.3/32;
                    }
                }
                then {
                    discard

                }
            }
        }
    }
  2. The final result of the route lookup is a next hop of discard:
    user@host# show routing-options
    static {
        route 192.168.1.3/32 discard ;
    }



The extended discard counter, in the show pfe statistics traffic output, reports the number of packets (notifications) that are silently discarded but that also need to be sent to the host  (Routing Engine) in order to be further processed.

Extended discard are reported when:
  1. Packets match a firewall filter term whose action includes both  discard and another action requiring processing by the Route Engine.
    (These include log, syslog, count, and sample.)
    Below there is an example with an additional firewall action of log :
    user@host# show firewall
        filter discard {
            term discard {
                from {
                    source-address {
                        192.168.1.3/32;
                    }
                }
                then {
                    log ;
                    discard ;
                }
            }
        }

    }

    In this case the host will log an entry into the firewall log:

    user@host# run show firewall log
    Log :
    Time      Filter    Action Interface     Protocol Src Addr     Dest Addr
    20:12:25  pfe       D      so-1/0/0.0    ICMP     192.168.1.3  192.168.1.1

Modification History

2022-08-16: Minor, non-technical edits.