FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
JaskiratM
Staff & Editor
Staff & Editor
Article Id 411106
Description

 

This article describes how to verify whether queues inside NP6XLite are stuck or building backlog, which may result in packet drops or latency.

 

Scope

 

FortiGate models with NP6XLite.

 

Solution

 

Run the following command:

 

fnsysctl cat /proc/net/np6xlite_0/pdq
IHP->ISW    00003dd6    00003dd6
HTX->ISW    000046ad    000046ad
LPBK->ISW   00000000    00000000
ISW->SSE    0000b2a6    0000b2a6
SSE_LBLC    0000ccc6    0000ccc6
SSE->OSW    0000b2a6    0000b2a6
PNM->OSW    00000000    00000000
OS->EHP    000046ad    000046ad
HRX_TUNPDQ  000015d4    000015d4
IPSEC_I     00000481    00000481
IPSEC_O     000029a2    000029a2
IPT_I       00000000    00000000
IPT_O       00000000    00000000
IPTO->PIPE  00000000    00000000
CWI         00000000    00000000
CWO         00000000    00000000
CWO>PIPE   00000000    00000000
OSW->PPF    00000000    00000000
PPF_PIPE    00000000    00000000
SYNK        00000000    00000000

 

Run this command multiple times at short intervals to track whether counters are increasing or queues are stalled.

 

Output meaning.

Each line represents a PDQ queue between two processing stages inside NP6XLite.

 

Fields:

  • wp_cnt (Write Pointer Count) – packets written into the queue.
  • rp_cnt (Read Pointer Count) – packets read from the queue.

 

Interpretation:

  • If wp_cnt == rp_cnt → Queue is healthy, packets are flowing.
  • If wp_cnt > rp_cnt → Queue backlog, potential packet drops due to overflow.
  • If wp_cnt < rp_cnt → Abnormal, possible counter reset or error (should be investigated).