FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Ehanssen
Staff
Staff
Article Id 418691
Description This article describes key fields in the HIF drop table.
Scope All FortiGates with NP6XLite chips
Solution

HIF stands for Host interface and the HIF-Stats shows traffic handled between NP6XLite and the CPU. Drops often occur when the CPU cannot process packets quickly enough, usually due to high CPU load, traffic bursts, or buffer limits.

 

To investigate HIF-related drops run the following commands. It is best to execute them multiple times while the issue is present to see which counters are increasing.

 

   fnsysctl date

   fnsysctl cat /proc/net/np6xlite_0/hif-stats
   fnsysctl cat /proc/net/np6xlite_0/hifdrop
   diagnose npu np6xlite session-stats
   fnsysctl cat /proc/net/np6xlite_0/hif-stats


Example output:

 

fnsysctl cat /proc/net/np6xlite_0/hif-st

 

rid rx_pkts    tx_pkts    egr_pkts   byte_nr    ipsec_rx   ipsec_ar_d ipsec_ol   ipt_rx     skalloc_e  nturbo_e  

    rx_drop    tx_drop    tx_full    ipsec_vif  ipsec_olv6 ipt_rx_d   len_e     

0   8810118    5902555    0          0          4112076    0          0          0          0          0         

    0          0          0          0          4973515    0          0         

1   15223298   7048933    0          0          7823923    0          0          0          0          0         

    0          0          0          0          3714827    0          0         

2   8669675    5853756    0          0          2291279    0          0          0          0          0         

    0          0          0          0          4527004    0          0         

3   9169775    7274266    0          0          4111992    0          0          0          0          0         

    0          0          0          0          3641667    0          0

 

Key fields:

 

  • rx_pkts: Packets received by the CPU from NP6XLite.
  • tx_pkts: Packets sent from the CPU back to NP6XLite.
  • egr_pkts: Packets egressed through NP (typically 0 in HIF context).
  • ipsec_rx: Decrypted IPsec packets passed to the CPU.
  • rx_drop: Packets dropped when receiving from NP.
  • tx_drop: Packets dropped while sending to NP.
  • tx_full: Transmit queue congestion – should ideally remain 0.
  • nturbo_e: Errors in nTurbo fast-path software, indicating issues with CPU packet acceleration.