Security Analytics Displays "Packet Capture Fidelity" Red Alert Due to Low Packet Drops

Products

• Security Analytics

Issue/Introduction

In the Security Analytics user interface, a red alert is displayed for Packet Capture Fidelity.

When expanding the Details section of the alert, you observe recorded packet drops along with a calculated Dropped Percentage.

Cause

The Packet Capture Fidelity alarm triggers a red alert status immediately upon detecting packet drops on monitored interfaces, regardless of how small the drop percentage is.

In many high-throughput network environments, a very low rate of packet drops (for example, less than 0.05%) is normal, expected, and typically does not indicate a system performance issue.

Resolution

For Low Drop Percentages (< 0.05%)

If the Dropped Percentage displayed in the details is extremely low (e.g., < 0.05%), this behavior is expected and the alert can safely be ignored.

For High Drop Percentages or Performance Concerns

If you observe a high drop percentage, or if you suspect network or appliance performance degradation, please gather the system diagnostics and open a case with Broadcom Support for further investigation.

Upcoming Feature (Version 8.4.1)

In the upcoming Security Analytics version 8.4.1 release, administrators will gain the ability to manually configure a minimum percentage threshold for this alert. This will prevent low-percentage, non-impactful packet drops from triggering false-positive red alerts in the UI.