Need to understand output of 'show ip eigrp events'

[spfister336]

I have a network with a central site plus about 30 remote sites (hub and spoke, EIGRP). A couple of the sites currently have no users or devices generating traffic, but are getting swamped with traffic transitioning to other sites. I'm at a loss to explain why this is happening. The output from 'show ip eigrp events' at the central site shows things that seem weird:

(1) There are a ton of lines like:

469 10:47:40.078 RDB delete: 10.99.41.0/24 10.99.89.35
470 10:47:40.078 RDB delete: 10.147.20.0/22 10.99.89.35
471 10:47:40.078 RDB delete: 10.200.1.0/27 10.99.89.35
472 10:47:40.078 RDB delete: 192.168.66.0/24 10.99.89.35
473 10:47:40.078 RDB delete: 10.127.20.0/22 10.99.89.35
474 10:47:40.078 RDB delete: 10.117.20.0/22 10.99.89.35
475 10:47:40.078 RDB delete: 172.17.0.0/20 10.99.89.35

The networks listed are not reachable through the next hop listed. Why are these here to be deleted in the first place?

(2) Lots of lines like:

5 10:53:28.164 Rcv query met/succ met: 4294967295 4294967295
6 10:53:28.164 Rcv query dest/nh: 192.168.35.0/24 10.99.89.41
7 10:53:28.164 Send reply: 10.135.0.0/16 10.99.89.41

Again... the network listed is never reachable through the next hop and never should be.

(3) Lines like:

179 10:53:45.588 Poison squashed: 192.168.135.0/24 reverse
180 10:53:45.588 Poison squashed: 192.168.35.0/24 reverse
181 10:53:45.588 Poison squashed: 10.135.0.0/16 reverse
182 10:53:45.588 Poison squashed: 10.35.0.0/16 reverse

I've read posts online about lines like these but I'm not sure I understand what's going on or where these are coming from

Any help will be greatly appreciated!

[fbabashahi]

Hi ,
it seems one router had these networks and lost them and with query try to reach them , if your network is hub and spoke maybe there is a problem with one of your spokes .
about the third part tou answer about poison reverse is here
https://www.cisco.com/c/en/us/support/docs/ip/enhanced-interior-gateway-routing-protocol-eigrp/13681-eigrpfaq.html#poison

Good Luck

[spfister336]

Yes, that's one of the things I found when looking for info on 'poison squashed'. It's kind of short and cryptic and I'm not sure what it's trying to say.

I'm still not sure why the traffic is going where it shouldn't. We have networks like 192.168.33.0/24 reachable only through through the next hop 10.99.89.33. When 10.99.89.33 is down, 192.168.33.0/24 is unreachable. The central site shouldn't be telling any other device to use 10.99.89.11 as the next hop since 10.99.89.11 isn't advertising that network. When 10.99.89.33 is up, traffic for a 10.99.89.11 advertised network shouldn't be transitioning through it.

[fbabashahi]

Please post your net diagram i hope can help you with that.

[fbabashahi]

about poison reverse it is about a network that is advertised after that receive from neighbor . in hub & spoke topology as i know most of the time the poison reverse disabled on HUB

[Georg Pauwen]

Hello,

on a side note, judging from your topology (hub/spoke) you might want to consider stub areas and sending only the default route from the hub. This should significantly reduce EIGRP related traffic:

Hub

interface GigabitEthernet0/0

description Link to Hub 1

ip summary-address eigrp 1 0.0.0.0 0.0.0.0

Spoke

router eigrp 1

eigrp stub

[spfister336]

I'll need to get some approval before posting a diagram here. 

Is disabling poison reverse something I should consider on the hub?
I have 'eigrp stub connected summary' on some of the spokes and not on others (I'm working on doing it everywhere.

[spfister336]

After some research, I think I'm getting a sense of poison reverse. Why is is "squashed"? 

[fbabashahi]

i think it is because you are getting back the advertised networks from a spoke