Symptom
Sympthoms can range from performance impact (as traffic will be concentrated on a particular RX ring).
Overruns on the Internal-Data interfaces (mainly on the RX ring that is most loaded).
firepower# show interface detail
Interface Internal-Data0/1 "", is up, line protocol is up
Hardware is , BW 500000 Mbps, DLY 1000 usec
(Full-duplex), (50000 Mbps)
Input flow control is unsupported, output flow control is unsupported
MAC address 0000.0041.0004, MTU not set
IP address unassigned
2541371689 packets input, 1953182001570 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 12517309 overrun, 0 ignored, 0 abort
0 pause input, 0 resume input
0 L2 decode drops, 0 demux drops
12 packets output, 336 bytes, 0 underruns
0 pause output, 0 resume output
0 output errors, 0 collisions, 0 interface resets
0 late collisions, 0 deferred
0 output decode drops
0 backplane ingress drops, 0 backplane egress drops
0 input reset drops, 0 output reset drops
Queue Stats:
RX[00]: 38879293 packets, 30629089687 bytes, 2138 overrun
Blocks free curr/low: 512/9
RX[01]: 34490948 packets, 25318330005 bytes, 111 overrun
Blocks free curr/low: 512/304
RX[02]: 26636517 packets, 18435188264 bytes, 68 overrun
Blocks free curr/low: 512/416
RX[03]: 1139339792 packets, 855343827567 bytes, 12510631 overrun
Blocks free curr/low: 264/39
...
As seen above RX[03] is receiving around 45% of the total traffic and essentially all the overruns.
Dispatch-queue-tail drops:
firepower# show asp drop
Frame drop:
Dispatch queue tail drops (dispatch-queue-limit) 755548710
Conditions
Having an ERSPAN interface configured on the FPR device (symptoms will depend on how much traffic is coming to this interface)
Using a 3100 or 4200 FPR device.
Workaround
Terminate the ERSPAN before sending traffic to the FPR device (essentially sending the decapsulated traffic to the FPR)
