It seems like Foglight Experience Monitor (FxM) is not getting traffic or much less traffic then expected.
When looking at ifconfig statics some large percentage are being dropped/discarded. When looking in the ecrit logs no packets are being discarded but the volume is lower then expected.
Collecting a tcpdump from the source, Gigamon for example, it is apparent that there are two or more VLAN headers.
These tcpdumps can’t be collected from the FxM appliance because the Linux kernel and the Ethernet card’s firmware sees these packets as invalid and discards them before the local system has a chance to include them in the tcpdump.
There should only be one VLAN header, the Linux kernel and the Ethernet card’s firmware see these packets as invalid.
Once a tcpdump has been collected from the source the issue can be verified in wireshark by seeing two or more VLAN headers in the packets.
+802.1Q Virtual LAN, PRI: 0, DEI: 0, ID: 829
+802.1Q Virtual LAN, PRI: 0, DEI: 0, ID: 536
The VLAN headers need to be stripped from the packets before the packets are sent to FxM.
In the case of Gigamon you find information here: