Automated determination of error-causing network packets utilizing network packet replay

A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device:

• to obtain a network trace comprising a plurality of network packets, the plurality of network packets having been received at a given network adapter of at least one information technology asset;
• to provision a test bed different than the at least one information technology asset for analyzing the obtained network trace, the test bed comprising a transmit host and a receive host, the receive host of the test bed comprising two or more ports associated with two or more different network adapter configurations;
• to replay at least a subset of the plurality of network packets in the obtained network trace from the transmit host of the test bed to a given one of the two or more ports of the receive host of the test bed, the given port of the receive host of the test bed being associated with a network adapter of the receive host having a given one of the two or more different network adapter configurations selected based at least in part on a network adapter configuration of the given network adapter of the at least one information technology asset;
• to parse port statistics of the given port of the receive host, the port statistics comprising error counters for one or more designated error types;
• and
• to determine, based at least in part on the parsed port statistics of the given port of the receive host, whether respective ones of the packets in the subset of the plurality of network packets comprise error-causing packets having at least a threshold likelihood of being sources of one or more alarms raised on the at least one information technology asset.

A method comprising:

• obtaining a network trace comprising a plurality of network packets, the plurality of network packets having been received at a given network adapter of at least one information technology asset;
• provisioning a test bed different than the at least one information technology asset for analyzing the obtained network trace, the test bed comprising a transmit host and a receive host, the receive host of the test bed comprising two or more ports associated with two or more different network adapter configurations;
• replaying at least a subset of the plurality of network packets in the obtained network trace from the transmit host of the test bed to a given one of the two or more ports of the receive host of the test bed, the given port of the receive host of the test bed being associated with a network adapter of the receive host having a given one of the two or more different network adapter configurations selected based at least in part on a network adapter configuration of the given network adapter of the at least one information technology asset;
• parsing port statistics of the given port of the receive host, the port statistics comprising error counters for one or more designated error types;
• and
• determining, based at least in part on the parsed port statistics of the given port of the receive host, whether respective ones of the packets in the subset of the plurality of network packets comprise error-causing packets having at least a threshold likelihood of being sources of one or more alarms raised on the at least one information technology asset;
• wherein the method is performed by at least one processing device comprising a processor coupled to a memory.