tcpdump and Forwarding (IP) Virtual Servers

What you are probably missing is the PVA accelerated traffic. If the traffic is processed inside the ASIC then tcpdump never sees it.

 

 

If the forwarder shows Full or Assisted for PVA acceleration, then that's likely the problem. You can create a fastL4 profile that specifically disables PVA and apply that to the forwarding virtual and then you should be able to see the traffic.

 

 

If you want to be more granular, you could create a forwarding virtual specifically for the application port involved and just apply the modified profile to that. That way you won't affect other traffic.

 

 

I have had situations where PVA acceleration caused problems for certain applications, so you can either turn PVA off as a temporary troubleshooting method, or you may find that leaving it off fixes your packet loss problem as well.

 

 

Denny