IPIP virtual interface experiencing discards

It's a very interesting question.

I've looked into the source code.

Seems like there is only single line related with incrementing of these counters.

Unfortunately you should use the kernel with enabled CONFIG_XFRM_STATISTICS option to see the exact reasons of these errors.

The brief description of errors read in the kernel documentation. More detailed meaning of these metrics you can see in the source code of xfrm_input functiion.


The problem was with replay window setting. Default Strongswan value of 32 was too small. Increased it to 1024 - errors disappeared.