Explanation of Drop code and Module-ID values for 6.1 firmware and below

Explanation of Drop code and Module-ID Values in Packet Capture Output

When viewing output on the System | Packet Capture page, there are two fields that display potentially useful diagnostic information in numeric format. The Module-ID field provides information on the specific area of the firewall (UTM) appliance's firmware that handled a particular packet. The Drop-Code field provides a reason why the appliance dropped a particular packet. . 

NOTE: Click on the Firmware version to view the Drop-Code details.

NOTE: Drop code numbers may change based on the firmware version, however, the drop code message (description) remains the same.

Additional drop code articles:

• How do I resolve drop code "Enforced Firewall Rule"?
• How do I resolve drop code "Cache Add Cleanup"?
• How do I resolve drop code "Packet Dropped - Policy Drop"?
• How do I resolve drop code "IP Spoof"?
• How do I resolve drop code "IDP Detection"?

Gen6 - SonicOS Enhanced 6.2.x

NOTE: All 6.2 firmware and newer contain the drop codes and descriptions within the packet capture utility. Find this by going to the packet capture located under System | Packet Monitor.
 

Gen6 -  SonicOS Enhanced 6.1.x

• 6.1.2.4-3n   (Only for NSA 2600)
• 6.1.2.3-20n (Only for NSA 260)
• 6.1.1.12-41n
• 6.1.1.10-4n
• 6.1.1.9-30n
• 6.1.1.8-25n
• 6.1.1.5-17n

Gen5 -  SonicOS Enhanced 5.9.x

• 5.9.1.0-22o
• 5.9.0.7-17o
• 5.9.0.6-3o

Gen5 -  SonicOS Enhanced 5.8.1.x

• 5.8.1.15-71o
• 5.8.1.14-68o