GroupStudy.com GroupStudy.com - A virtual community of network engineers
 Home  BookStore  StudyNotes  Links  Archives  StudyRooms  HelpWanted  Discounts  Login
RE: UDP socket error on Cat6500 Switch [7:81568] posted 12/29/2003
[Chronological Index] [Thread Index] [Top] [Date Prev][Date Next] [Thread Prev][Thread Next]


This is related to UDP traffic destined to the router/switch itself. Some
documetation on the Internet says that the UDP port in the message is the
destination port but other documents say that it is the source and that
probably the error is related to traffic destined to the SNMP UDP port 161.
So be sure to check for excessive SNMP polling for one thing.

To find the source IP address of the device(s) causing this traffic, use a
protocol analyzer and the Switched Port Analyzer (SPAN) feature. Since the
UDP traffic is destined to the CPU of the switch, set the SPAN source port
to sc0.

Try looking up UDP_SOCKOVFL with Google for more info.

Priscilla

Devraj, Prem wrote:
> 
> Hi All,
> 
> Needed Help in identifying the source IP to this problem.
> 
> Can someone tell me on how to find the Source IP address.
> 
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52129 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52135 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52149 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52160 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52161 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52163 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52167 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52171 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52175 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52183 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52190 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52194 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52032 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52030 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52028 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52026 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52056 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52053 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52051 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52050 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52042 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52057 overflow
> Dec 29 08:53:43 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52065 overflow
> Dec 29 08:53:44 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52063 overflow
> Dec 29 08:53:44 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52067 overflow
> Dec 29 08:53:44 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52080 overflow
> Dec 29 08:53:44 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52087 overflow
> Dec 29 08:53:44 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52088 overflow
> Dec 29 08:53:44 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52091 overflow
> Dec 29 08:53:44 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52210 overflow
> Dec 29 08:53:44 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52103 overflow
> Dec 29 08:53:44 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52098 overflow
> Dec 29 08:53:44 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52107 overflow
> Dec 29 08:53:44 [10.28.0.135.4.1] 2003 Dec 29 07:53:23 jst
> +08:00
> %IP-3-UDP_SOCKOVFL:UDP socket 52116 overflow
> 
> regds
> prem
> 
> 
>
-----------------------------------------------------------------------------------------------------------------------------------------
> The information contained herein is confidential and is
> intended solely for the
> addressee. Access by any other party is unauthorised without
> the express
> written permission of the sender. If you are not the intended
> recipient, please
> contact the sender either via the company switchboard on +81
> (0)3 5403 9500, or
> via e-mail return. If you have received this e-mail in error or
> wish to read our
> e-mail disclaimer statement and monitoring policy, please refer
> to
> http://www.drkw.com/disc/email/ or contact the sender.
>
-----------------------------------------------------------------------------------------------------------------------------------------
> 
> 




Message Posted at:
http://www.groupstudy.com/form/read.php?f=7&i=81592&t=81568
--------------------------------------------------
**Please support GroupStudy by purchasing from the GroupStudy Store:
http://shop.groupstudy.com
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html