Explanation of Drop code and Module-ID Values in Packet Capture Output SonicOS 5.9.0

Description

Explanation of Drop code and Module-ID Values in Packet Capture Output (SonicOS Enhanced 5.9.0.7.17n firmware)

Resolution

When viewing output on the System > Packet Capture page, there are two fields that display potentially useful diagnostic information in numeric format. The Module-ID field provides information on the specific area of the firewall (UTM) appliance's firmware that handled a particular packet. The Drop-Code field provides a reason why the appliance dropped a particular packet. This article provides a list of the Module-ID and Drop-Code numbers along with their meanings.

Please Note: The following Drop-Codes were extracted from SonicOS Enhanced 5.9.0.7.17 firmware version, however these codes may change when a new firmware is available. When unsure please contact SonicWall support.

Module ID and Module Name:

0 
1  adminTools
2  attacks
3  av
4  bwmmgmt
5  CIA
6  cli
7  clients
8  config
9  connectionCache
10  contentFilter
11  dea
12  debug
13  dhcpRelay
14  dhtml
15  fileSystem
16  fwCore
17  ha
18  idp
19  ipHelper
20  ipSec

21  lib
22  log
23  modem
24  netObj
25  network
26  packetFilter
27  policy
28  pppStack
29  RADIUS acct
30  redirector
31  reports
32  resource
33  sarc
34  servers
35  snmp
36  spdpp
37  stateful
38  system
39  TRAV2
40  TSA

41  USERS
42  version
43  wizards
44  wlan
45  wlb
46  zones
47  ARP
48  system stack
49  PPTP
50  L2TP
51  PPP-Dialup
52  IGMP
53  PPPOE
54  NAT
55  anti-spam
56  NetMonitor
57  Mirroring
58  SIP
59  BandOpt
60  QoS
61  IPv6
62  ICMPv6
63

 

Drop-Code:

 Error code and Name  

0 
1  Unknown Ether type.
2  IPv6 packets not supported.
3  Packet on invalid vlan
4  Packet on invalid interface
5  Invalid HA packet
6  Invalid HA ARP packet
7  PPPoE discover packet not allowed
8  Invalid HA SDP packet
9  Routing packet not allowed
10  VLAN filtered. 
11  L2B Learning-Bridge filtered
12  Invalid NET-ID found.
13  Invalid Run-time NET data.
14  Unknown ARP type.
15  Arp reply ignored.
16  IP address not for our subnet
17  NULL source IP address
18  Own gratuitous arp
19  IP address not on our lan subnet
20  Classical mode, ARP bridge not supported
21  ARP proxy, subnet mismatch
22  Not for me.
23  Invalid TCP Flag
24  Invalid TCP Options
25  IP sanity test failed
26  Non sonicpoint traffic in wlan zone
27  Multicast spank attack
28  Multicast Data packet dropped
29  Load Balancing Probe error
30  Syn Flood Protection
31  IP source route option found
32  Invalid connection cache.
33  Unknown destination
34  Bounce traffic detected
35  Access Rule Policy not found
36  AV detection
37  SEC detection
38  DEA detection
39  Bad TFTP packets
40  Enforced firewall rule
41  LICENSE drop
42  IDP detection
43  Packet to public IP from inside firewall
44  Bad TTL
45  IP check failed
46  Bad source IP
47  Bad destination MAC address
48  Broadcast not allowed on bridge.
49  Going to blacklisted server.
50  coming from blacklisted server.
51  Broadcast traffic not handled.
52  Multicast forwarding not configured
53  Multicast IGMP state not found
54  Multicast IP not in the allowed list
55  Anti-Spam Connection Limit Reached
56  Active/Active DPI drop offload packet
57  UDP Flood Protection
58  ICMP Flood Protection
59  Unknown Ether type
60  Incorrect IP Version
61  Blacklisted MAC address
62  Wrong IP Length
63  Packet length mismatch with interface MTU
64  Wrong fragmentation boundary.
65  Wrong IP checksum value.
66  Wrong TCP Checksum value.
67  Wrong UDP Checksum value.
68  Wrong ICMP Checksum value.
69  NULL Udp port number
70  Non PPP-GRE traffic
71  Missing ESP Header
72  Missing AH Header
73  Missing IPCOMP Header
74  Unknown IP protocol type
75  TTL value is zero.
76  l2 mcast but dest ip is unicast
77  Null Source Zone.
78  Wrong UDP Length.
79  RECV: IP pkt recvd without IPCP session
80  RECV: TNMP can't alloc contiguous buf
81  XMIT: AHDLC encap no buf
82  XMIT: TNMP can't alloc contiguous buf
83  XMIT: Device not ready to forward traffic
84  XMIT: No IPCP session
85  XMIT: No Dialup Msg Buffer available
86  Non Zero GIAddr field in DHCP packet from client
87  Source MAC is different from chAddr field in DHCP client packet
88  Iphelper policy not found for DHCP relay.
89  Iphelper cache not found for DHCP.
90  Zero NSID in Netbios request packet.
91  Iphelper policy not found for Netbios.
92  Iphelper cache not found for Netbios.
93  Zero NSID in Netbios reply packet.
94  Ingress interface is same as egress interface.
95  DHCP server packet dropped, RPF check failed.
96  Netbios packet dropped, RPF check failed.
97  Other Application packet dropped, RPF check failed.
98  Iphelper policy not found for other Application.
99  Memory Allocation Error.
100  Length Mismatch. Cant forward pkt!!!.
101  Control message header size error.
102  Drop GRE packet as call not yet established.
103  Invalid GRE Flags or Caller ID.
104  Invalid GRE sequence number.
105  No payload for GRE packet.
106  PPTP Tunnel is not up yet.
107  PPTP Client is not enabled.
108  PPTP Spin Lock Error.
109  PPTP Flow Control Queuing Error.
110  Error copying PPTP combuf chain to continuous buffer.
111  Error fragmenting packet that is larger than PPTP MTU.
112  Enforced Dial-on-Data restriction.
113  PPPDU has not completed initialization.
114  Error fragmenting packet that is larger than PPPDU MTU.
115  PPPDU dropped packet because packet that is larger then PPPDU MTU and fragmentation is disabled.
116  Packet received with DF bit Set and large than MTU
117  PPP link is not up/available.
118  The PPP buffer processing failed.
119  Received PPP pkt but there is no existing PPP information.
120  PPP Network Interface structure is NULL.
121  PPP Virtual Interface structure is NULL.
122  PPP dropped packet because it contains unknown protocol.
123  PPP dropped packet because of transmission failure.
124  PPP dropped packet because NCP is not open.
125  PPP dropped packet because the LCP code is unacceptable.
126  PPPOE packet has no payload.
127  The PPPOE buffer processing failed.
128  The PPPOE module is not yet ready.
129  The PPPOE module is not enabled.
130  The PPPOE module is not re/started with NTP packets.
131  The PPPOE module dropped the packet because it was non-IP.
132  PPPoE packet has unsupported version.
133  Received PPPoE packet for non-existent PPP session
134  PPPoE packet has an illegal session id.
135  PPPoE packet has unknown ethertype.
136  PPPoE packet is missing the service name tag.
137  PPPoE packet was not transmitted.
138  PPPoE packet dropped due to failure in adding enet header.
139  L2TP Length Mismatch
140  L2TP UDP checksum error
141  L2TP buffer corrupted
142  L2TP invalid tunnel
143  L2TP invalid session
144  L2TP Invalid source interface
145  L2TP packet not encrypted
146  L2TP Drop PPP control packet, session not established yet
147  L2TP Tunnel/Seesion Invalid
148  L2TP invalid pkt type
149  L2TP invalid control msg
150  L2TP unsupported version

151  L2TP not enabled on this interface
152  L2TP invalid packet
153  L2TP invalid runtime data
154  L2TP connection not UP
155  L2TP memory allocation failed
156  No IPSec tunnel active for this connection ,
157  Invalid L2TP Mode ,
158  Pkt pass to stack failed
159  UDP length greater than 1500
160  IP length greater than 1500
161  Pkt authentication failed
162  SA not found on lookup by SPI after decryption
163  SA not found on lookup by SPI after encryption
164  Failed to copy frag chain to contiguous buffer
165  Pkt with SPI less than 256
166  SA not found on lookup by SPI for inbound packet
167  Pkt length smaller than expected
168  Replayed Pkt
169  Pkt received on invalid interface
170  Expecting udp encapsulation
171  Not expecting udp encapsulation
172  Throughput regulator drop inbound pkt
173  HW processing request error for inbound pkt
174  AH auth failed
175  ESP auth failed
176  ESP decrypt failed
177  Unknown protocol
178  Nested tunnels not supported
179  Pkt is not thru tunnell
180  Pkt is not thru tunnel or l2tp transport mode
181  Pkt not destined to mgmt interface
182  Pkt from invalid peer
183  VPN access list check failure
184  Pkt does not match traffic selectors
185  Pkt fragment not allowed
186  DHCP pkt invalid IP length
187  Octeon Decrypyion Failed for inbound packet
188  Incoming packet's combuf Ip Length Error
189  Combuf Ip Ptr Null Error
190  Multicast sa not found
191  SA not found on lookup by SPI for outbound pkt
192  Incorrect src IP on mgmt SA
193  Throughput regulator drop outbound pkt
194  Insufficient command context for outbound pkt
195  HW processing request error for outbound pkt
196  Software esp decrypt processing request error
197  Software esp auth processing request error
198  Software ah auth processing request error
199  Software null sa processing request error
200  Software processing request error
201  Combuf Fragmentation error
202  Packet is large than MTU
203  Packet received with DF bit Set and large than MTU
204  Sequence overflow while encryting packet
205  Encption error for out going packet
206  Combuf Ip Ptr NUll Error
207  Combuf Ip Length Error
208  Next Hope ARP not Resolved
209   Multicast buffer error
210   No IGMP entry found
211   No IGMP interface entry found
212   Combuf fields mismatch iplen-enet not equal to etherhdr size
213   IGMP wrong Checksum
214   Multicast not enabled
215   IGMP state table error
216   IGMP message error
217   IGMPV3 message error
218   IGMP version not supported
219   Multicast RTP stateful failed
220  IP Spoof check failed
221  OutGoing interface not available
222  Cache pointer is NULL. NAT policy lookup cannot be performed
223  Cache add to hash table failed
224  NAT policy remap failed
225  NAT policy generate unique remap port failed
226  NAT policy lookup failed. Cache add aborted
227  Connection cache is full
228  Get VPN tunnel interface from policy failed
229  Packet from bounced path
230  Half open ESP connection
231  Half open IPCOMP connection
232  Allocate memory for connection cache failed
233  Connection Cache Add Failed
234  NAT Remap: Source IP not found in NAT Policy's Original Source Address Object
235  NAT Remap: Destination IP not found in NAT Policy's Original Destination Address Object
236  NAT Remap: Service not found in NAT Policy's Original Service Object
237  NAT Remap: Obtained invalid offset in original source
238  NAT Remap: Obtained invalid offset in oringinal destination
239  NAT Remap: Invalid address object type configured for original source
240  NAT Remap: Invalid address object type configured for original destination
241  NAT Remap: Invalid address object type configured for translated source
242  NAT Remap: Obtained invalid translated source from original offset
243  NAT Remap: Obtained invalid translated destination IP
244  NAT Remap: Size of translated destination object is zero
245  NAT Remap: Unable to find a host that is alive from translated destination pool
246  NAT Remap: Size of translated service object is zero
247  NAT Remap: Obtained invalid offset in original service
248  NAT Remap: Obtained invalid translated service from original offset
249  Packet marked to be dropped on ingress
250  Packet marked to be dropped on egress
251  Packet dropped by BWM CBQ as there is no default queue
252  Packet dropped by BWM CBQ as the queue is full
253  Packet dropped by BWM ACKQ as the queue is full
254  Packet dropped by BWM ACKQ as there is no default queue
255  Packet dropped due to BWM spin lock error
256  MAC-IP Anti-spoof check enforced for hosts.
257  MAC-IP Anti-spoof cache not found for this router.
258  MAC-IP Anti-spoof cache found, but it is not a router.
259  MAC-IP Anti-spoof cache found, but it is blacklisted device.
260  Packet dropped - IDP failure on sslspy packet
261  Packet droppedd - Content filter failure on sslspy packet
262  Packet dropped - failed processing
263  Packet dropped - failed SIP pre-processing
264  Packet dropped - failed SIP post-processing
265  Packet dropped - unknown SIP method
266  Packet dropped - unknown Call-ID in method
267  Packet dropped - invalid Contact:
268  Packet dropped - invalid Call-ID:
269  Packet dropped - invalid Via:
270  Packet dropped - invalid From:
271  Packet dropped - invalid To:
272  Packet dropped - invalid RecordRoute:
273  Packet dropped - invalid Maddr:
274  Packet dropped - invalid Route:
275  Packet dropped - invalid ACK

276  Packet dropped - invalid method
277  Packet dropped - invalid ReferredBy:
278  Packet dropped - invalid ReferredTo:
279  Packet dropped - invalid BYE
280  Packet dropped - invalid CANCEL
281  Packet dropped - invalid INVITE
282  Packet dropped - invalid REGISTER
283  Packet dropped - SDP body not found
284  Packet dropped - bad SDP content length
285  Packet dropped - bad SDP c=
286  Packet dropped - bad SDP m=
287  Packet dropped - failed SDP processing
288  Packet dropped - Geo-IP block for init country
289  Packet dropped - Geo-IP block for resp country
290  Packet dropped - BOTNET block for init command and control center
291  Packet dropped - BOTNET block for resp command and control center
292  Packet dropped - HA not allowed
293  IPv6 Internal Error
294  IPv6 packet with option.
295  IPv6 next header validation failed.
296  IPv6 virtual firewall ID not found.
297  IPv6 packets on non IPv6 enabled interface.
298  IPv6 interface state is DOWN.
299  Source Zone is not defined.
300  Invalid TCP flag detected.
301  Firewall rul applied.
302  Connection cache add failed.
303  Cleanup needed for connection cache failed .
304  Maximum hop allowed for this IPv6 packet has reached.
305  Src IP as link local but pkt not for us.
306  SRC RPF Failed
307  Pkt need redirection, not supported
308  Stack destined packet, cant handle for now.
309  IPv6 packet with ICMPv4.
310  Interface has no IP addresses.
311  Dest IP as solNode mcast but not for us
312  Src IP is not valid
313  Source IP is spoofed
314  Null Dst IP
315  NULL src IP, not supported
316  Src IP is non unicast pkt
317  Dst route not found
318  Dst IP is LLU but not for us
319  Dst IP is non unicast pkt
320  Dst IF same as SRc IF, redirect not supported
321  Dst IF is not V6 enabled
322  AH and ESP extn hdr found, dropped
323  ipLen mismatch with payloadLen
324  No 6to4 relay Ip specified
325  Non 2002:: src ip packet destined for 6to4 relay
326  Incoming Ipv6 tunnel pkt failed for IPspoof
327  Incoming Ipv6 tunnel pkt from stack
328  Incoming IPv6 tunnel pkt failed for IPspoof
329  Non unicast pkt trying for tunnel to relay
330  pkt in from tunnel and going back to tunnel
331   pkt in from relay and going back to relay
332  Connection initiated from WAN ZONE, not allowed
333  Connection initiated from WLAN ZONE, not allowed
334  No cache but tcp packet with no syn
335  failed to resolve ngbr
336  pkt destined to us, management via IPv6 not allowed
337  Source IP is a multicast address
338  pkt dropped due to ndpp rules
339  pkt dropped due to ip fragmentation length is smaller than Minimum IPV6 MTU(1280 Bytes)
340  pkt dropped due to cache pointer is NULL
341  IPv6 address is reserved
342  internal ICMP module error
343  Not allowed to reply on ping pkt
344  Parsing inner ICMPv6 error payload as non UDP/ICMPv6
345  Parsing inner ICMPv6 error payload as non UDP/ICMPv6
346  Wrong hopLimit in the IP header
347  ICMP echo reply not allowed on dst Ip as mcast.
348  incoming interface is not v6 enabled
349  src ip not in our subnet
350  unknown icmp type
351  fragmented icmpv6 packet
352  icmpv6 packet from tunnel interface
353  echo packet with null srcip
354  pkt with null srcIp not directed at multicast dst ip
355  Sol message srcIP is null but option is present dropped
356  reply option received.
357  Unknown option.
358  No option but dstIP is multicast.
359  bad length in ngbr sol msg.
360  bad icmp len
361  bad length in rtr sol msg, dropped.
362  Unknown option, discarded.
363  target option received, discarded.
364  bad length in ngbr adv msg, dropped.
365  Unknown option, discarded.
366  source option received, discarded.
367  icmpv6 smurf amplification, dropped.
368  -

 

 

Related Articles

  • SonicOS 8.1.0 FAQ
    Read More
  • SonicWall GEN8 TZs and GEN8 NSas Settings Migration
    Read More
  • Getting started with SonicWall firewalls
    Read More
not finding your answers?