Seeing a lot of "decoder.invalid" when using bond interface

Help
#1

When using a bond interface in af-packet and workers mode, i see the “decoder.invalid” counter increasing constantly.

capture.kernel_packets                        | Total                     | 15725713
capture.kernel_drops                          | Total                     | 116756
decoder.invalid                               | Total                     | 1683697

capture.kernel_packets                        | Total                     | 22913657
capture.kernel_drops                          | Total                     | 173964
decoder.invalid                               | Total                     | 2152034

I noticed that the "decoder.invalid" value ins the same has "decoder.event.ipv4.trunc_pkt | Total | 2152034

#2

What version are you running?
How does your suricata.yaml look like?
How do you start suricata?

How is the traffic forwarded?
Bond interfaces can be tricky

#3
  1. Version 6.0.9
  2. Af-packet mode, cluster-flow and workers running mode
  3. Start Suricata with systemctl
  4. Traffic is being mirrored from the switch

bond interface is configured in balance-rr mode

#4

What is the reason for the bond interface?
You could try to compare it without the bond to see if there is a diff.