We saw this on a 100Mb connection to our DMZ.
So we used that same logic, must be too much traffic spiking.
We even lowered the handful of servers in the DMZ to 100Full -- no change.
So now we have a 5540 with a gig connections. No difference, still getting thousands and thousands of overruns.
Now we even see overruns on outside and a few on inside.
I see this on multiple customers, multiple ASA & PIX configs.
I'm not sure if it is an obscure accounting issue - for instance the ASA reports an SNMP discarded packet for every DENY. So suddenly you'll have millions of discards on your ethernet port which has nothing to do with ethernet discards but are Layer 3- Layer-7 discard. The ethernet packet was accepted as a valid packet. This is the first firewall to report denys as SNMP reported interface discards.
If it is a performance issue it is something low level and TAC was not able to help us to determine what was wrong. We got the same explanation about exceeding port. The 100 Mb NIC was receiving traffic from the 100Mb Siwtchport faster than allowed (by the hardware installed in the firewall). We aren't exceeding 100Mb--just exceeding the capabilty of the hardware Cisco chose for their NICs & firewall.
The theory is bursts. The theory always seems to be it is bursts.
