Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Resolving "dropped retransmit" and "rxjammed" package losses in Deep Security

    • Updated:
    • 25 Oct 2016
    • Product/Version:
    • Deep Security 9.0
    • Deep Security 9.5
    • Deep Security 9.6
    • Platform:
    • Windows 10 32-bit
    • Windows 10 64-bit
    • Windows 2003 Enterprise
    • Windows 2003 Enterprise 64-bit
    • Windows 2003 Server R2
    • Windows 2003 Standard
    • Windows 2003 Standard 64-bit
    • Windows 2008 Datacenter 64-bit
    • Windows 2008 Enterprise
    • Windows 2008 Enterprise 64-bit
    • Windows 2008 Server R2
    • Windows 2008 Server R2 Datacenter
    • Windows 2008 Server R2 Enterprise
    • Windows 2008 Standard 64-bit
    • Windows 2012 Datacenter R2
    • Windows 2012 Enterprise
    • Windows 2012 Enterprise R2
    • Windows 2012 Standard R2
    • Windows 7 32-Bit
    • Windows 7 64-Bit
    • Windows 8 32-Bit
    • Windows 8 64-Bit
    • Windows 8.1 32-Bit
    • Windows 8.1 64-Bit
    • Windows Vista 32-bit
    • Windows Vista 64-bit
    • Windows XP Professional
    • Windows XP Professional 64-bit
    • Windows XP SP2 32-bit
    • Windows XP SP3 32-bit
Summary

Fix the "dropped retransmit" event detected by the Deep Security Network Engine, and not solely by the Firewall module. This solution applies whether the event was detected by a Deep Security Virtual Appliance (DSVA), by an installed Deep Security Agent (DSA), or by an agentless machine.

Details
Public

The "dropped retransmit" event means that a duplicated packet was dropped by the network engine. Since the first packet was successfully received, the duplicated packet dropped by DSA or DSVA has no impact. On the other hand, "rxjammed" means that a received packet was mixed up. These firewall events are not recorded by default.

The issue can be prevented by using a bypass rule. The following procedure can also be considered to resolve the event:

  1. Open the Deep Security Manager (DSM) console.
  2. Go to Settings > Network Engine.
  3. Select the Advanced tab.
  4. On the Advanced Logging Policy drop-down list, choose Default. This enables the logging to switch to Tap Mode if the engine is in Tap Mode, and to Normal Mode if the engine is in Inline Mode.

    Default Advanced Logging Policy

Premium
Internal
Rating:
Category:
Troubleshoot
Solution Id:
1115617
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.