windows_exporter/docs/runbooks/windowsnetworkdiscards.md

title

title
WindowsNetworkDiscards

Meaning

Discarded inbound and outbound packets make up more than the configured share of all packets on an interface for 15 minutes. The default networkDiscardRatioThreshold is 1 percent. The ratio divides the discard rates (windows:net_received_discarded:rate plus windows:net_outbound_discarded:rate) by the packet rates (windows:net_received_packets:rate plus windows:net_sent_packets:rate). Discards count packets dropped without a packet error, such as buffer exhaustion. Interfaces that carry no packets produce no sample and cannot alert. The alert keeps firing for keepFiringFor after the ratio drops below the threshold.

Impact

Dropped packets can cause retransmissions, reduced throughput, and application timeouts. Some drops may be expected under a deliberate traffic policy.

Diagnosis

1. Inspect windows:net_received_discarded:rate and windows:net_outbound_discarded:rate to identify the direction and affected nic, and compare them with the packet rate recordings to see whether a low packet rate inflates the ratio.
2. Compare traffic, directional utilization ratios, and windows_net_output_queue_length_packets with the normal baseline.
3. Inspect Get-NetAdapterStatistics, switch-port drops, adapter buffers, virtual switch counters, and network QoS policies.
4. Correlate drops with CPU pressure, traffic bursts, hypervisor contention, and application failures. An unknown or zero bandwidth estimate produces no utilization sample and should not be interpreted as zero traffic.

Mitigation

Relieve congestion, distribute traffic, or add bandwidth. Correct buffer, driver, or virtual switch problems when evidence identifies them. Review intentional drop policies with the network owner before raising networkDiscardRatioThreshold. Confirm discard rates and application retransmissions return to the expected baseline.