[Sorry for the delay in responding to this]

On Mon, 2006-01-02 at 23:00 -0500, John Rouillard wrote:

>  A tcpdump on S of the query from A is:

> 03:35:00.758456 IP (tos 0x0, ttl  64, id 469, offset 0, flags [DF], proto 17,
>     length: 117) S.snmp > A.57133: [bad udp cksum 8a66!]  { SNMPv2c
>       { GetResponse(74) R=531627557  
>         system.sysUpTime.0=339026
>         interfaces.ifTable.ifEntry.ifOutOctets.2=4067270909
>           interfaces.ifTable.ifEntry.ifInOctets.2=1082932159 } }
> 
> An snmpget -d shows:

>   Received 89 bytes from S
>   0000: 30 57 02 01  01 04 06 70  75 62 6C 69  63 A2 4A 02    0W.....public.J.
>   0016: 04 7C 57 9B  3E 02 01 00  02 01 00 30  3C 30 0F 06    .|W.>......0<0..
>   0032: 08 2B 06 01  02 01 01 03  00 43 03 05  2C 58 30 13    .+.......C..,X0.
>   0048: 06 0A 2B 06  01 02 01 02  02 01 10 02  41 05 19 F2    ..+.........A...
>   0064: 6E 23 B5 30  14 06 0A 2B  06 01 02 01  02 02 01 0A    n#.0...+........
>   0080: 02 41 06 02  BE 40 96 A7  6F                          [EMAIL 
> PROTECTED]

Unpacking that dump, the if*Octets varbinds are as follows:

   30 13
      06 0A   2B 06 01 02 01 02 02 01 10 02   (ifOutOctets.2)
      41 05   19 F2 6E 23 B5
              ^^^^^^^^^^^^^^
   30 14
      06 0A   2B 06 01 02 01 02 02 01 0A 02   (ifInOctets.2)
      41 06   02 BE 40 96 A7 6F
              ^^^^^^^^^^^^^^^^^

These two values (indicated by ^^^^) are both > 32-bits,
and don't match the values listed in the tcpdump output.
These would be represented as (41 05) 00 f2 6d a0 fd 
and (41 04) 40 83 cb bf respectively.


That also fits with the S->S results, which are both
larger than the maximum allowed for a 32-bit value.

It looks as if the agent isn't wrapping these counters properly
at 2^32, and this is confusing the (32-bit) clients.

Dave


-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
Net-snmp-users mailing list
Net-snmp-users@lists.sourceforge.net
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users

Reply via email to