-
Products
-
SonicPlatform
SonicPlatform is the cybersecurity platform purpose-built for MSPs, making managing complex security environments among multiple tenants easy and streamlined.
Discover More
-
-
Solutions
-
Federal
Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn MoreFederalProtect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn More - Industries
- Use Cases
-
-
Partners
-
Partner Portal
Access to deal registration, MDF, sales and marketing tools, training and more
Learn MorePartner PortalAccess to deal registration, MDF, sales and marketing tools, training and more
Learn More - SonicWall Partners
- Partner Resources
-
-
Support
-
Support Portal
Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn MoreSupport PortalFind answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn More - Support
- Resources
- Capture Labs
-
- Company
- Contact Us
Explanation of Drop code and Module-ID Values in Packet Capture Output (SonicOS 6.1.2.2-14n)
03/26/2020 
1,043 People found this article helpful
484,256 Views
Description
When viewing output on the System | Packet Capture page, there are two fields that display potentially useful diagnostic information in numeric format:
- The Module-ID field provides information on the specific area of the firewall appliance's firmware that handled a particular packet.
- The Drop-Code field provides a reason why the appliance dropped a particular packet.
This article provides a list of the Module-ID and Drop-Code numbers along with their meanings.
The following Drop-Codes were extracted from SonicOS Enhanced 6.1.2.2-14n firmware version, however these codes may change when a new firmware is available.
Resolution
When viewing output on the System > Packet Capture page, there are two fields that display potentially useful diagnosticinformation in numeric format. The Module-ID field provides information on the specific area of the firewall (UTM) appliance'sfirmware that handled a particular packet. The Drop-Code field provides a reason why the appliance dropped a particularpacket. This article provides a list of the Module-ID and Drop-Code numbers along with their meanings.
Please Note: The following Drop Codes were extracted from SonicOS Enhanced 6.1.2.2-14n �firmware version. These codes may change when a new firmware is available. If unsure, please contact SonicWall support.
�
| 1 � � � ��� � adminTools 2 � � � ��� � attacks 3 � � � ��� � av 4 � � � ��� � bwmmgmt 5 � � � ��� � CIA 6 � � � ��� � cli 7 � � � ��� � clients 8 � � � ��� � config 9 � � � ��� � connection Cache 10 � � � � � contentFilter 11 � � � � � dea 12 � � � � � debug 13 � � � � � dhcpRelay 14 � � � � � dhtml 15 � � � � � fileSystem 16 � � � � � fwCore 17 � � � � � ha 18 � � � � � idp 19 � � � � � ipHelper 20 � � � � � ipSec | 21 � � � ��� � �lib 22 � � � ��� � �log 23 � � � ��� � �modem 24 � � � ��� � �netObj 25 � � � ��� � �network 26 � � � ��� � �packetFilter 27 � � � ��� � �policy 28 � � � ��� � �pppStack 29 � � � ��� � �RADIUS acct 30 � � � ��� � �redirector 31 � � � ��� � �reports 32 � � � ��� � �resource 33 � � � ��� � �sarc 34 � � � ��� � �servers 35 � � � ��� � �snmp 36 � � � ��� � �spdpp 37 � � � ��� � �stateful 38 � � � ��� � �system 39 � � � ��� � �TRAV2 40 � � � ��� � �TSA 41 � � � ��� � �USER | 42 � � � ��� � �version 43 � � � ��� � �wizards 44 � � � ��� � �wlan 45 � � � ��� � �wlb 46 � � � ��� � �zones 47 � � � ��� � �ARP 48 � � � ��� � �system stack 49 � � � ��� � �PPTP 50 � � � ��� � �L2TP 51 � � � ��� � �PPP-Dialup 52 � � � ��� � �IGMP 53 � � � ��� � �PPPOE 54 � � � ��� � �NAT 55 � � � ��� � �anti-spam 56 � � � ��� � �NetMonitor 57 � � � ��� � �Mirroring 58 � � � ��� � �SIP 59 � � � ��� � �BandOpt 60 � � � ��� � �GMSFlow server 61 � � � ��� � �APPFlow server 62 � � � ��� � � |
| DROP CODES |
| Drop Code ID and name |
| 0 1 PIP handling error in CP 2 PIP handling error in DP 3 Packet on the backup aggregate interface, but no Sonic END can be found. 4 Broadcast packet on the backup redundant port when primary port is up. 5 Packet the redundancy port, but no Sonic END can be found. 6 CP throttled DP for stack traffic 7 Packet dropped due to pass to stack failed. 8 Packet dropped by outputhook. 9 Inter-blade Packet dropped due to CP pass to stack failed. 10 HA active data packet processing failed. 11 Packet dropped due to CP pass to stack failed. 12 Dispatching IEEE802 BPDU packet failed. 13 IEEE 802 BPDU support module has not been initialized yet. 14 Invalide Ether type for IEEE 802 BPDU packet. 15 Invalide source address for IEEE 802 BPDU packet. 16 Unknown Ether type ingress. 17 Unknown Ether type egress. 18 IPv6 packets not supported. 19 Packet on invalid vlan 20 Packet ingress on invalid interface 21 Packet egress on invalid interface 22 Packet on invalid device 23 Destination MAC address is not our interface 24 Device is not attached. 25 Packet on invalid svrrp group 26 Invalid HA packet 27 Invalid HA ARP packet 28 PPPoE discover packet not allowed 29 Invalid HA SDP packet 30 Routing packet not allowed 31 VLAN filtered. 32 Unicast MACADDR not mine 33 L2B Learning-Bridge filtered 34 Invalid NET-ID found on mist if write. 35 Invalid NET-ID found on if write arp real. 36 Invalid NET-ID found on write ip fast. 37 Invalid NET-ID found on if write. 38 Invalid NET-ID found on if write no mbuf. 39 Invalid Run-time NET data on mist if write. 40 Invalid Run-time NET data on if write arp real. 41 Invalid Run-time NET data on write ip fast. 42 Invalid Run-time NET data on if write. 43 Invalid parent Run-time NET data on if write. 44 Invalid Run-time NET data on if write no mbuf. 45 Invalid parent Run-time NET data on if write no mbuf. 46 Unknown ARP type. 47 Arp reply ignored. 48 IP address not for our subnet 49 ARP unexpected link ip 50 ARP source ip not connected 51 NULL source IP address 52 Own gratuitous arp 53 IP address not on our lan subnet 54 Classical mode, ARP bridge not supported 55 ARP proxy, subnet mismatch 56 Not for me. 57 ARP request from stack 58 ARP response from stack 59 ARP fail to resolve from SonicPoint 60 ARP unknown ethernet address format 61 Invalid TCP Flag 62 Invalid TCP Options 63 IP sanity test failed 64 IP sanity test failed in out hook 65 IP advanced sanity test failed 66 Non sonicpoint traffic in wlan zone 67 Multicast spank attack 68 Multicast Data packet dropped 69 Load Balancing Probe error 70 Syn Flood Protection 71 Duplicated in Syn Flood Protection 72 Syn Flood Protection #3 73 IP source route option found 74 Invalid connection cache. 75 Unknown destination 76 Unknown destination for bridged bcast pkt 77 Bounce traffic detected 78 Access Rule Policy not found 79 AV detection 80 DEA detection 81 Bad TFTP packets 82 Enforced firewall rule 83 LICENSE drop 84 IDP detection 85 IDP detection, bad tcp checksum 86 IDP detection, bad ip checksum in tcp checking 87 IDP detection, bad ip checksum in tcp packet 88 IDP detection, bad udp checksum 89 IDP detection, bad ip checksum in udp checking 90 IDP detection, bad ip checksum in udp packet 91 IDP detection, bad icmp checksum 92 IDP detection, bad ip checksum in icmp checking 93 IDP detection, bad ip checksum in icmp packet 94 Packet to public IP from inside firewall 95 Bad TTL 96 IP check failed 97 Bad source IP 98 Bad destination MAC address 99 Broadcast not allowed on bridge. 100 Antispam: Going to blacklisted server. 101 Going to blacklisted server. 102 coming from blacklisted server. 103 Broadcast traffic not handled. 104 Multicast forwarding not configured 105 Multicast IGMP state not found 106 Multicast IP not in the allowed list 107 Anti-Spam Connection Limit Reached 108 Active/Active DPI drop offload packet 109 UDP Flood Protection 110 ICMP Flood Protection 111 Unknown Ether type 112 Incorrect IP Version 113 Blacklisted MAC address 114 Wrong IP Length 115 Packet length mismatch with interface MTU 116 Wrong fragmentation boundary. 117 Wrong IP checksum value. 118 Wrong TCP Checksum value. 119 Wrong UDP Checksum value. 120 Wrong ICMP Checksum value. 121 NULL Udp port number 122 Non PPP-GRE traffic 123 Missing ESP Header 124 Missing AH Header 125 Missing IPCOMP Header 126 Unknown IP protocol type 127 TTL value is zero. 128 l2 mcast but dest ip is unicast 129 Null Source Zone. 130 Wrong UDP Length. 131 RECV: IP pkt recvd without IPCP session 132 RECV: IP pkt recvd without contiguous buf 133 RECV: IP pkt recvd without combuf 134 RECV: TNMP can't alloc contiguous buf 135 XMIT: AHDLC encap no buf 136 XMIT: TNMP can't alloc contiguous buf 137 XMIT: Device not ready to forward traffic 138 XMIT: No IPCP session 139 XMIT: IPCP is down 140 XMIT: No Dialup Msg Buffer available 141 Non Zero GIAddr field in DHCP packet from client 142 Source MAC is different from chAddr field in DHCP client packet 143 Iphelper policy not found for DHCP relay. 144 Iphelper cache not found for DHCP. 145 Zero NSID in Netbios request packet. 146 Iphelper policy not found for Netbios. 147 Iphelper cache not found for Netbios. 148 Zero NSID in Netbios reply packet when recv from server. 149 Zero NSID in Netbios reply packet when recv from client. 150 Zero NSID in Netbios reply packet. 151 Netbios client no egress element 152 Netbios server no egress element 153 Netbios client fail to create record 154 DHCP server fail to relay to client 155 DHCP client no egress element 156 DHCP client fail to create record 157 DHCP server, Ingress interface is same as egress interface. 158 Firewall, Ingress interface is same as egress interface. 159 Other Application, Ingress interface is same as egress interface. 160 Ingress interface is same as egress interface. 161 DHCP server packet dropped, RPF check failed. 162 Netbios client packet dropped, RPF check failed. 163 Netbios server packet dropped, RPF check failed. 164 Other Application relay to client failed 165 Other Application no egress element 166 Other Application fail to create record 167 Other Application packet dropped, RPF check failed. 168 Other Application client packet dropped, RPF check failed. 169 Other Application server packet dropped, RPF check failed. 170 Iphelper policy not found for other Application. 171 Iphelper policy not found for other Application when creating record. 172 Combuf Allocation Error. 173 Memory Allocation Error. 174 BSEG Memory Allocation Error. 175 Length Mismatch. Cant forward pkt!!!. 176 Control message header size error. 177 Drop GRE packet as call not yet established. 178 Invalid GRE Flags or Caller ID. 179 Invalid GRE sequence number. 180 No payload for GRE packet. 181 PPTP Tunnel is not up yet. 182 PPTP Client is not enabled. 183 PPTP WAN Write Spin Lock Error. 184 PPTP Spin Lock Error. 185 PPTP Flow Control Queuing Error. 186 Error copying PPTP combuf chain to continuous buffer. 187 Error fragmenting packet that is larger than PPTP MTU. 188 Enforced Dial-on-Data restriction. 189 PPPDU has not completed initialization. 190 Error fragmenting packet that is larger than PPPDU MTU. 191 PPPDU dropped packet because packet that is larger then PPPDU MTU and fragmentation is disabled. 192 Packet received with DF bit Set and large than MTU 193 PPP MLP link is not up/available. 194 PPP link is not up/available. 195 PPP link is not up. 196 PPP link is not opened. 197 The PPP buffer processing failed. 198 LCP: The PPP buffer is truncated. 199 The PPP buffer decompressing failed. 200 NCP: The PPP buffer is truncated. 201 PPP MLP pre-xmit error. 202 PPP MLP encapsulate error. 203 PPP MLP null pointer found. 204 PPP MLP no data packet. 205 PPP MLP link is not opened. 206 PPP MLP buffer decompressing failed. 207 PPP MLP BAP no netif nlinfo. 208 PPP MLP IP no netif nlinfo. 209 PPP MLP NBF no netif nlinfo. 210 PPP MLP VJCOMP no netif nlinfo. 211 PPP MLP VJCOMP decompressing failed. 212 PPP MLP VJUNCOMP no netif nlinfo. 213 PPP MLP VJUNCOMP decompressing failed. 214 PPP MLP IPX no netif nlinfo. 215 PPP MLP IPX decompressing failed. 216 PPP MLP AT no netif nlinfo. 217 PPP MLP 802.1 no netif nlinfo. 218 PPP MLP IBMSR no netif nlinfo. 219 PPP MLP DECLAN no netif nlinfo. 220 PPP MLP BRIDGE no netif nlinfo. 221 PPP MLP NBFCP no netif nlinfo. 222 PPP MLP IPCP no netif nlinfo. 223 The PPP PAP buffer processing failed. 224 The PPP CHAP buffer processing failed. 225 The PPP NCP buffer processing failed. 226 The PPP LCP buffer processing failed. 227 Received PPP pkt but there is no existing PPP information. 228 PPP Network Interface structure is NULL. 229 PPP Virtual Interface structure is NULL. 230 PPP no active link. 231 PPP dropped packet because it contains unknown protocol. 232 PPP dropped packet because of transmission failure. 233 PPP MLP NCP processing failed 234 PPP dropped packet because NCP is not open. 235 PPP dropped packet because the LCP code is unacceptable. 236 PPP dropped packet because the LCP code is unknown. 237 PPP HDLC PPPOE packet has no payload. 238 PPPOE packet has no payload. 239 The PPPOE buffer processing failed. 240 The PPPOE ingress buffer processing failed. 241 The PPPOE egress buffer processing failed. 242 PPPOE packet dropped because of NULL pointer. 243 PPPOE packet dropped because of NULL pointer in DP. 244 PPPOE packet dropped because BSEG allocation failed. 245 PPPOE packet dropped because buf put head action failed. 246 PPPOE packet dropped because PADO create PAD packet failed. 247 PPPOE packet dropped because PADI create PAD packet failed. 248 PPPOE packet dropped because PADR create PAD packet failed. 249 The PPP HDLC ingress buffer processing failed. 250 The PPP HDLC egress buffer processing failed. 251 The PPP HDLC dropped because of NULL pointer. 252 The PPP HDLC dropped because of NULL pointer in DP. 253 PPP HDLC packet dropped because BSEG allocation failed. 254 PPP HDLC packet dropped because buf put head action failed. 255 The PPP HDLC buffer processing failed. 256 The PPP HDLC PPPOE IPCP is not up. 257 The PPP HDLC PPPOE is not ready. 258 The PPP HDLC PPPOE is not ready in DP. 259 The PPPOE IPCP is not up. 260 The PPPOE module is not yet ready. 261 The PPPOE module is not yet ready in DP. 262 The PPP HDLC PPPOE is not enabled. 263 The PPP HDLC PPPOE is not enabled in DP. 264 The PPPOE module is not enabled. 265 The PPPOE module is not enabled in DP. 266 The PPP HDLC PPPOE is not re/started with NTP packets. 267 The PPP HDLC PPPOE is not re/started with NTP packets in DP. 268 The PPPOE module is not re/started with NTP packets. 269 The PPPOE module is not re/started with NTP packets in DP. 270 The PPP HDLC PPPOE is not re/started with non-IP packets. 271 The PPP HDLC PPPOE is not re/started with non-IP packets in DP. 272 The PPPOE module dropped the packet because it was non-IP. 273 The PPPOE module dropped the packet because it was non-IP in DP. 274 PPP HDLC PPPoE packet has unsupported version. 275 PPPoE packet has unsupported version. 276 Received PPP HDLC PPPOE packet for non-existent PPP session. 277 Received PPP HDLC PPPOE packet for non-existent PPP session in DP. 278 Received PPPoE packet for non-existent PPP session. 279 Received PPPoE packet for non-existent PPP session in DP. 280 PPPoE packet has an illegal session id. 281 PPPoE packet has unknown ethertype. 282 PPPoE packet is missing the service name tag. 283 PPPoE packet was not transmitted. 284 PPPoE packet dropped due to failure in adding enet header. 285 L2TP Length Mismatch 286 L2TP UDP checksum error 287 L2TP buffer corrupted 288 L2TP invalid tunnel 289 L2TP invalid session 290 L2TP Invalid source interface 291 L2TP packet not encrypted 292 L2TP Drop PPP control packet, session not established yet 293 L2TP Tunnel/Seesion Invalid 294 L2TP invalid pkt type 295 L2TP invalid control msg 296 L2TP unsupported version 297 L2TP invalid packet 298 L2TP not enabled on this interface 299 L2TP invalid runtime data 300 L2TP connection not UP 301 L2TP memory allocation failed 302 No IPSec tunnel active for this connection , 303 Invalid L2TP Mode , 304 Pkt pass to stack failed 305 UDP length greater than 1500 306 IP length greater than 1500 307 Pkt authentication failed 308 SA not found on lookup by SPI after decryption 309 SA not found on lookup by SPI after encryption 310 Failed to copy frag chain to contiguous buffer 311 Pkt with SPI less than 256 312 SA not found on lookup by SPI for inbound packet 313 Pkt length smaller than expected 314 Replayed Pkt 315 Pkt received on invalid interface 316 Expecting udp encapsulation 317 Not expecting udp encapsulation 318 Throughput regulator drop inbound pkt 319 Throughput regulator drop inbound pkt in CP 320 HW processing request error for inbound pkt 321 AH auth failed 322 ESP auth failed 323 ESP decrypt failed 324 Unknown protocol 325 Nested tunnels not supported 326 Pkt is not thru tunnell 327 Pkt is not thru tunnel or l2tp transport mode 328 Pkt not destined to mgmt interface 329 Pkt not destined to mgmt interface in CP 330 Pkt not destined to mgmt interface (non-octeon) 331 Pkt from invalid peer 332 VPN access list check failure 333 VPN access list check failure in CP 334 VPN access list check failure (non-octeon) 335 Pkt does not match traffic selectors 336 Pkt fragment not allowed 337 DHCP pkt invalid IP length 338 Octeon Decrypyion Failed for inbound packet 339 Incoming packet's combuf Ip Length Error 340 Combuf Ip Ptr Null Error 341 Multicast sa not found 342 SA not found on lookup by SPI for outbound pkt 343 Incorrect src IP on mgmt SA 344 Throughput regulator drop outbound pkt 345 Throughput regulator drop outbound pkt in CP 346 Insufficient command context for outbound pkt 347 HW processing request error for outbound pkt 348 Software esp decrypt processing request error 349 Software esp auth processing request error 350 Software ah auth processing request error 351 Software null sa processing request error 352 Software processing request error 353 Software malloc combuf fragment error 354 Combuf Fragmentation error 355 Combuf Fragmentation error after encryption 356 Combuf Fragmentation error after encryption in CP 357 Packet is large than MTU 358 Packet is large than MTU after encryption 359 Packet received with DF bit Set and large than MTU 360 Sequence overflow while encryting packet 361 Encption error for out going packet 362 Combuf Ip Ptr NUll Error 363 Combuf Ip Length Error 364 Next Hope MAC ARP error 365 Next Hope ARP not Resolved 366 Multicast buffer error 367 No IGMP entry found when leaving 368 No IGMP entry found when forwarding 369 No IGMP interface entry found 370 Combuf fields mismatch iplen-enet not equal to etherhdr size 371 IGMP wrong Checksum 372 Multicast not enabled 373 IGMPv2 state table error 374 IGMPv3 state table error 375 IGMP message has invalid length 376 IGMP message has invalid destination 377 IGMP message has invalid subtype 378 IGMPv3 message has invalid data length 379 IGMPv3 message has less data record 380 IGMPv3 message is invalid 381 IGMP query message version is not supported 382 IGMP report message version is not supported 383 IGMP message version is unknown 384 IGMP version not supported 385 Multicast RTP stateful failed 386 IP Spoof check failed 387 OutGoing interface not available 388 OutGoing interface is invalid 389 Cache pointer is NULL. NAT policy lookup cannot be performed 390 Cache add to hash table failed 391 NAT policy remap failed 392 NAT policy generate unique remap port failed 393 NAT policy lookup failed. Cache add aborted 394 Connection cache is full 395 Get VPN tunnel interface from policy failed 396 Packet from bounced path from initiator 397 Half open ESP connection 398 Half open IPCOMP connection 399 Allocate memory for connection cache failed 400 NAT Remap: Source IP not found in NAT Policy's Original Source Address Object 401 NAT Remap: Destination IP not found in NAT Policy's Original Destination Address Object 402 NAT Remap: Service not found in NAT Policy's Original Service Object 403 NAT Remap: Obtained invalid offset in original source 404 NAT Remap: Obtained invalid offset in oringinal destination 405 NAT Remap: Invalid address object type configured for original source 406 NAT Remap: Invalid address object type configured for original destination 407 NAT Remap: Invalid address object type configured for translated source 408 NAT Remap: Obtained invalid translated source from original offset 409 NAT Remap: Obtained invalid translated destination IP 410 NAT Remap: Size of translated destination object is zero 411 NAT Remap: Unable to find a host that is alive from translated destination pool 412 NAT Remap: Size of translated service object is zero © 2024 SonicWall. All Rights Reserved. |
YES
NO