Resolving Performance Protection and Layer2 Fallback Issues in TippingPoint Inspection Devices

Summary

This article provides a step-by-step guide to diagnosing and resolving performance degradation and Layer2 fallback issues in TippingPoint inspection devices caused by filter over-configuration.

Symptoms

• Device enters Performance Protection Mode
• Layer2 fallback is activated
• High packet drop rates

Root Cause

The primary cause is engine congestion, often due to:

• Filters sending traffic into deep inspection without triggering matches
• High overhead from filters with no hits, overloading the inspection engine

Resolution Steps

Step 1: Identify Problematic Filters

1. Access CLI: SSH into the TippingPoint device.
2. Run Command:

   show np rule-stats

3. Analyze Output:

   Filter   Flows   Success   % Total   % Success   Zoneless   % Zoneless
   8262     2535    0         14        0.00        0           0
   ...

   Column Descriptions:

   • Filter: Filter ID
   • Flows: Number of flows sent to deep inspection
   • Success: Number of successful matches
   • % Total: Share of total deep inspection flows
   • % Success: Match rate
   • Zoneless: Flows triggered on segments where the filter is not enabled
   • % Zoneless: Ratio of zoneless triggers
4. Identify Filters to Disable:

   Focus on filters with high % Total and 0% Success. Example: Filter 8262 is a candidate for disabling.

Step 2: Disable Unnecessary Filters

1. Log into SMS: Use the TippingPoint SMS Java client
2. Navigate to:

   Profiles > Inspection Profiles > [Profile Name] > Search

3. Edit Filter: Locate the filter, click Edit and set State to Disabled
4. Distribute Profile:

   Profiles > Inspection Profiles > Highlight [Profile Name] > Distribute

Step 3: Clear Rule Statistics

Run the following command to clear outdated statistics:

clear np rule-stats

Step 4: Monitor Device Performance

• Observe the device for 24–48 hours
• Watch for recurrence of Performance Protection or Layer2 fallback

Step 5: Further Analysis and Tuning

• Re-run show np rule-stats
• Identify additional filters with low success rates
• Adjust Category Settings:
  • Avoid setting categories to actions other than Recommended
  • Non-recommended settings may enable excessive filters

Conclusion

By following these steps, performance issues in TippingPoint devices can be mitigated. Regular monitoring and filter tuning are essential. For persistent issues, contact Trend Micro Support.

References

• TPS Command Line Reference
• TippingPoint SMS User Guide