nv-l
[Top] [All Lists]

Re: Constant multicast by netmon

To: nv-l@lists.tivoli.com
Subject: Re: Constant multicast by netmon
From: Mark Sklenarik <markskl@ibm.net>
Date: Wed, 18 Aug 1999 22:28:32 -0400
Jane,
I am see a similar thing here in the lab, I have a number of NetWare
machines that are adding the interface 224.0.0.2 to them, the interface is
moving from machine to machine, but always appears to be a NetWare machine
where the interface appears. The address is jumping between 3 NetWare
machines.  I have been unable to date to determine what application would
be making request to the 224.0.0.1 address.  I will check the NetView
object in the morning.

If it is Nways, the problem is also in 1.2.3.  I am running AIX 4.3.2,
Framework 3.6 and 3.6.1, and NV 5.1.1 and testing 5.1.2, and Nways 2.0 and
1.2.3.

Number of questions:
* Have you tried a !224.0.0.* in the seedfile?
* Does the NetView machine have a working Ethernet or token-ring interface?
* Is the 224.0.0.1 address appearing in the mib-2 "at" table has last
entry?
* Have you tried to flush the arp cache on the NetView machine?
* Does the address come right back?
* Does the address appear to be moving from machine to machine?
* Have you been able to determine what application in the network might be
making request to the address?  Other than netmon?  An entry would be
appearing in some machines mib-2 "at" table?  When netmon discovers that
node, it gets the "at" table and adds the address to those to go discover.

The HSRP trap you see, is being caused by the method in which 224.0.0.1 is
being discovered, the definition matches what NetView uses to determine if
Cisco routers are configured in a HSRP many.


Mark Sklenarik
Tivoli NetView Product Integrity, RTP

-----Original Message-----
From:   Jane Curry [SMTP:jane.curry@SKILLS-1ST.CO.UK]
Sent:   Wednesday, August 18, 1999 8:00 AM
To:     NV-L@UCSBVM.ucsb.edu
Subject:        Constant multicast by netmon

AIX 4.2.1 with latest patches, Fwork 3.6.1, NV 5.1.1, Nways V2.

I have started seeing constant multicast SNMP packets (~30 / sec) being
sent by netmon to 224.0.0.1 (ALL-SYSTEMS.MCAST.NET) with the community
name of  my NetView system (which doesn't apply to everything else).
netmon does a total CPU hog, traffic is crazy, lots of systems are
sending community name traps.  If I try and delete my NetView machine's
224.0.0.1 interface, it seems to delete the whole node and, I think core
dumps.  The node gets rediscovered back and it rediscovers the 224.0.0.1
again which it seems to think is an HSRP interface!

What's changed I hear you ask??  Well, I've just installed Nways V2 - is
this coincidence??  I have now ensured that when NetView daemons and
EUIs start, they don't bring up Nways but it's still happening. Next
step is to completely clear all the databases.

If this rings any bells with anyone, PLEASE share.
Thanks,
Jane
--
Tivoli Certified Enterprise Consultant
Skills 1st Limited, 2 Cedar Chase, Taplow, Bucks, SL6 0EU, UK
Tel: +44 (0)1628 782565
Copyright (c) 1999 Jane Curry <jane.curry@skills-1st.co.uk>.  All rights
reserved.


<Prev in Thread] Current Thread [Next in Thread>

Archive operated by Skills 1st Ltd

See also: The NetView Web