The cpu load is normal (10%) for all the time. There is a possibility that is an attack, but if I control nat translation, cpu, int stat , I find no trace for background traffic. Teresa ----- Original Message ----- From: Reinhold Fischer To: Teresa Presutto Cc: [EMAIL PROTECTED] Sent: Friday, August 24, 2001 9:16 AM Subject: Re: sh arp The packet counters for incoming packets/sec look not very reasonable. Especially when relating them to the outgoing packets/sec. How high is the cpuload on the box ? Is there a possibility that some kind of attack is going on on the ethernet interface ? What confuses me a bit is that there are no drops or ignores with that high packets/sec value. Another thing to notice it that the collision rate is about 10%. Replacing the HUB/Shared media there with a switch would sure be a good idea ... Cisco's error message decoder results this about your error: http://www.cisco.com/support/Errordecoder/error-decoder.html # %AMDP2_FE-3-UNDERFLO: AMDP2/FE 0/0/[dec], Transmit underflow # # While transmitting a frame, the local buffer of the controller # chip received insufficient data because data could not be # transferred to the chip fast enough to keep pace with its # output rate. Normally, such a problem is temporary, depending # on transient peak loads within the system. The system should # recover. # # Recommended Action: No action is required. # # Related documents: No specific documents apply to this error message. This could also be a hint that there is unusual cpu load on the router. I would check the cpu load on the router. If it is unusual high (near 100%) shutdown the ethernet interface and see if the cpu load drops down. If this is the case go and find the hacked boxes on the lan ... Reinhold On Thu, 23 Aug 2001, Teresa Presutto wrote: > It didn't ping successfully. > In the sho log I see the following line: > UTC: %AMDP2_FE-3-UNDERFLO: Ethernet0/1 transmit error > > I reloaded the router and now I can see all the MAC address in the arp cache. > By the way something is going wrong... > > see this two sh int output > grp_ge#sh int eth0/1 > Ethernet0/1 is up, line protocol is up > Hardware is AmdP2, address is 00b0.6469.4641 (bia 00b0.6469.4641) > Description: "LAN Uffici Genova" > Internet address is 172.17.1.33/24 > MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec, > reliability 255/255, txload 1/255, rxload 58/255 > Encapsulation ARPA, loopback not set > Keepalive set (10 sec) > ARP type: ARPA, ARP Timeout 04:00:00 > Last input 00:00:01, output 00:00:00, output hang never > Last clearing of "show interface" counters 00:58:52 > Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 > Queueing strategy: weighted fair > Output queue: 0/1000/64/0 (size/max total/threshold/drops) > Conversations 0/2/256 (active/max active/max total) > Reserved Conversations 0/0 (allocated/max allocated) > Available Bandwidth 7500 kilobits/sec > 30 second input rate 2286000 bits/sec, 4703 packets/sec > 30 second output rate 8000 bits/sec, 13 packets/sec > 16568680 packets input, 1006250867 bytes, 0 no buffer > Received 2701 broadcasts, 0 runts, 0 giants, 0 throttles > 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored > 0 input packets with dribble condition detected > 41880 packets output, 20367226 bytes, 0 underruns(1268/2497/0) > 0 output errors, 3765 collisions, 0 interface resets > 0 babbles, 0 late collision, 6301 deferred > 0 lost carrier, 0 no carrier > 0 output buffer failures, 0 output buffers swapped out > > and after few seconds > > grp_ge#sh int eth0/1 > Ethernet0/1 is up, line protocol is up > Hardware is AmdP2, address is 00b0.6469.4641 (bia 00b0.6469.4641) > Description: "LAN Uffici Genova" > Internet address is 172.17.1.33/24 > MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec, > reliability 255/255, txload 1/255, rxload 58/255 > Encapsulation ARPA, loopback not set > Keepalive set (10 sec) > ARP type: ARPA, ARP Timeout 04:00:00 > Last input 00:00:01, output 00:00:00, output hang never > Last clearing of "show interface" counters 00:59:13 > Input queue: 1/75/0/0 (size/max/drops/flushes); Total output drops: 0 > Queueing strategy: weighted fair > Output queue: 0/1000/64/0 (size/max total/threshold/drops) > Conversations 0/2/256 (active/max active/max total) > Reserved Conversations 0/0 (allocated/max allocated) > Available Bandwidth 7500 kilobits/sec > 30 second input rate 2282000 bits/sec, 4695 packets/sec > 30 second output rate 4000 bits/sec, 8 packets/sec > 16670090 packets input, 1012418296 bytes, 0 no buffer > Received 2716 broadcasts, 0 runts, 0 giants, 0 throttles > 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored > 0 input packets with dribble condition detected > 42038 packets output, 20377608 bytes, 0 underruns(1268/2501/0) > 0 output errors, 3769 collisions, 0 interface resets > 0 babbles, 0 late collision, 6318 deferred > 0 lost carrier, 0 no carrier > 0 output buffer failures, 0 output buffers swapped out > > From: Odell Waters > To: [EMAIL PROTECTED] > Sent: Thursday, August 23, 2001 8:05 PM > Subject: RE: sh arp [7:17012] > > > Try pinging the addresses that came up in your arp cache as incomplete. If > it pings successfully then look at the arp cache. You should then see the > MAC associated with the IP addresses following a successful ping. Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=17101&t=17101 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
