Counts reassembly failures for whatever reason, timeout or error, noting this isn't necessarily a precise count of discarded fragments since some algorithms lose track once fragments are combined. On a security gateway, a rising ipReasmFails alongside ipReasmReqds indicates fragmented traffic is arriving but not completing, worth investigating as either a hostile fragmentation-evasion attempt or a path dropping some fragments through asymmetric routing or a filtering middlebox. Example: ipReasmFails rising in lockstep with ipReasmReqds, both isolated to one VPN peer, points to that specific tunnel losing fragments in transit rather than a general firewall problem.