I like Leslie's response, because, as usual, it is succinct and to the point
about how best to use the product.
The answer to the question about "why read the arp cache" is simple. Without it
you could not do discovery without a seed file. It is part of the basic netmon
design, going back to HP's original patent, that netmon starts discovery in his
own subnet by reading his own arp cache to find other nodes, and then he reads
their arp to find more, and so on.
>From the sound of things, it appears that Craig, who asked the original
question, doesn't want to manage anything other than routers and networks, (he
wanted to know why netmon couldn't just read route tables in the routers) so
for him, it makes sense to ask "why do this?", since he has to code a seed file
to prevent discovery of what he doesn't want any way. But reading the arp
cache allows you to find things on the same subnet and to detect newly added
devices.
James Shanks
Team Leader, Level 3 Support
Tivoli NetView for UNIX and NT
lclark@US.IBM.COM on 07/31/2000 10:41:06 AM
Please respond to IBM NetView Discussion <nv-l@tkg.com>
To: IBM NetView Discussion <nv-l@tkg.com>
cc: (bcc: James Shanks/Tivoli Systems)
Subject: RE: [NV-L] ARP cache retrieval?
Well, I cannot get any more specific about how it actually works and why,
because I do not really know and usually do not care.
When I want to minimize network impact, after I am sure I have a good
discovery,
I do these things:
Turn off speed node discovery (netmon configuration)
Turn off new node discovery (Options..Topology) , or schedule it for an
infrequent interval (Options..SNMP)
Schedule configuration polling for an infrequent interval (Options...SNMP)
Reduce the number of routing table entries pulled from default of 800
(Options..
SNMP).
Make sure I'm on V6.
If you are discovering more than you want, like PCs and printers, study up
on
seedfiles. You can exclude by snmp sysobject id.
Cordially,
Leslie A. Clark
IBM Global Services - Systems Mgmt & Networking
(248) 552-4968 Voicemail, Fax, Pager
"Treptow, Craig" <Treptow.Craig@principal.com>@tkg.com on 07/30/2000
12:04:47 PM
Please respond to IBM NetView Discussion <nv-l@tkg.com>
Sent by: owner-nv-l@tkg.com
To: "'IBM NetView Discussion'" <nv-l@tkg.com>
cc:
Subject: RE: [NV-L] ARP cache retrieval?
Thanks Leslie!
Is this related at all to the "Discovery Polling" option in the SNMP
configuration? I have shut that off in an attempt to address this issue as
well.
Also, can you speak to why Netview would want the ARP cache? It seems that
it
will and has discovered all sorts of devices that we don't care about (PC's
and printers). Couldn't discovery happen with just learning the routes
from
the routers? Or am I way off base here?
-----Original Message-----
From: lclark@US.IBM.COM [mailto:lclark@US.IBM.COM]
Sent: Sunday, July 30, 2000 8:27 AM
To: IBM NetView Discussion
Subject: Re: [NV-L] ARP cache retrieval?
When you configure netmon, you will see an option to support secondary
addresses.
This is on by default in V6 (it was off by default in earlier releases). It
is required to be
on to support HSRP discovery and management. In certain kinds of network
configs
this retrieval of arp cache is pretty painful. You can reduce the pain by
reducing the
frequency of new node discovery. In 6.01 you will also see a new kind of
demandpoll
that just pings all of the interfaces and skips the expensive snmp polls.
If you are not
doing HSRP, and if your routers only have one address assigned to each
interface,
then you can probably live without secondary address support. I would not
turn it off,
however, until you were pretty satisfied with your basic network discovery.
Cordially,
Leslie A. Clark
IBM Global Services - Systems Mgmt & Networking
Detroit
"Treptow, Craig" <Treptow.Craig@principal.com>@tkg.com on 07/28/2000
04:31:46 PM
Please respond to IBM NetView Discussion <nv-l@tkg.com>
Sent by: owner-nv-l@tkg.com
To: "NetView List (E-mail)" <nv-l@tkg.com>
cc: "Treptow, Craig" <Treptow.Craig@principal.com>
Subject: [NV-L] ARP cache retrieval?
Hi. We are running Netview v6 on AIX. We just did a test by doing a
test->demand poll on a couple of routers and watched as their CPU
utilization
went to the high 90's and sometimes 100%. It appeared to be the worst
during
the "Getting ARP table data for discovery of secondary interfaces" phase
(or
something close to that verbage).
Can we prevent this ARP cache dumping? If we can, will it prevent
discovery
of new devices?
Also, where/how may I search the archives of this list?
Thanks for any help!
Craig Treptow
Principal Financial Group
I/S Network Administration
(515) 247-6207
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l
|