You get the TRUNCATED entries when the following happens.
In RX_RING Mode ( basically TPACKET_V2 ) each "frame" is of a fixed size - this maps to a packet. In Trisul-Probe for example this is 8K or so. When packets are larger that 8K, we only capture the first 8K and increment the TRUNCATED counter.
Now why are ethernet packets greater than 8K, the reason is due to Hardware Offload on Gig E/ 10G cards. The normal suggestion is
- turn off TCP Segmentation Offload (tso)
- turn off Generic Segmentation Offload (gso)
using the following
ethtool -K eth2 tso off
ethtool -K eth2 gso off
But you also need to turn off Generic Receive Offload ! This is on newer kernels that replaces the LRO (Large Receive Offload) I am not sure your card has this - but the INTEL PRO 1000's do support this option. Check the gro and turn that off too
ethtool -K eth2 gro off
If this is available , it should stop the TRUNCATED. Yes, these indicate packet loss because Trisul does not feed Truncated packets into the TCP Reassembly engines.