When a packet cannot be handed to the next processing stage because a queue is full, a packet‑buffer‑allocator (PBA) leak is detected, a congestion flag (CG_FULL) is set, or a specific security module (IPsec, IHP, L2P, etc.) rejects the packet, and hence the DCE increments the corresponding drop counter.
The counters are per‑module (Ingress Header Processing, Host TX, IP‑Tunnel Inbound, Reassembly, Extensible Header Processing, L2P, Host Interface, IPsec, etc.) and can be displayed or cleared with the diagnose npu np7 dce‑* family of commands.
Use the command below to see which part of the packet‑processing pipeline is rejecting traffic.
diagnose npu np7 dce-drop-all (and the module‑specific dce‑* commands)
Correlate DCE counters with congestion flags (CG_FULL) and PBA leak information to pinpoint whether the problem is a full queue, a resource leak, or a feature‑specific denial (IPsec, reassembly, etc.).
If CG_FULL (Congestion Group Full)is non‑zero, the NP reports congestion; if '!!!Leak!!!' appears in the PBA output, buffers are not being released.
Related article:
Technical Guide: Understanding the FortiGate NP7 packet flow & drop types for troubleshooting packet loss issues | 
