Buy or Renew
Buy or Renew
This forum is no longer in read-only mode. See this post for updates
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
1544
Views
2
Helpful
5
Replies

SNMP Returning Invalid IP: 0.1.134.160

Go to solution
efries_wy
Level 1
Level 1

‎06-05-2025 11:45 AM - edited ‎06-05-2025 12:34 PM

We have multiple CBS350 switches that when queried via SNMP, the switch returns an invalid IP address 0.1.134.160, along with several correct IP's.  The invalid IP is the same on multiple switches at multiple clients.

Walking SNMP on one of the switches returns this data.

walkOid 804613751910470352 1.3.6.1.2.1.4.20
URL: https://clientname.clientmonitor.yyy

 804613751910470352 sw-fl2-sg350-28p-1-20  SG350-28P 28-Port Gigabit PoE Managed Switch  
                    0.1.134.160, 10.2.12.3, 10.10.0.3
oid                             |valueInt|valueString    
--------------------------------+--------+---------------
1.3.6.1.2.1.4.20.1.1.0.1.134.160|        |0.1.134.160
1.3.6.1.2.1.4.20.1.1.10.2.12.3  |        |10.2.12.3
1.3.6.1.2.1.4.20.1.1.10.10.0.3  |        |10.10.0.3
1.3.6.1.2.1.4.20.1.1.127.0.0.1  |        |127.0.0.1
1.3.6.1.2.1.4.20.1.1.169.254.0.1|        |169.254.0.1
1.3.6.1.2.1.4.20.1.2.0.1.134.160|  100000|None
1.3.6.1.2.1.4.20.1.2.10.2.12.3  |  100011|None
1.3.6.1.2.1.4.20.1.2.10.10.0.3  |  100019|None
1.3.6.1.2.1.4.20.1.2.127.0.0.1  |   20000|None
1.3.6.1.2.1.4.20.1.2.169.254.0.1|    8000|None
1.3.6.1.2.1.4.20.1.3.0.1.134.160|        |255.255.255.255
1.3.6.1.2.1.4.20.1.3.10.2.12.3  |        |255.255.255.0
1.3.6.1.2.1.4.20.1.3.10.10.0.3  |        |255.255.254.0
1.3.6.1.2.1.4.20.1.3.127.0.0.1  |        |0.0.0.0
1.3.6.1.2.1.4.20.1.3.169.254.0.1|        |255.255.255.0
1.3.6.1.2.1.4.20.1.4.0.1.134.160|       1|None
1.3.6.1.2.1.4.20.1.4.10.2.12.3  |       1|None
1.3.6.1.2.1.4.20.1.4.10.10.0.3  |       1|None
1.3.6.1.2.1.4.20.1.4.127.0.0.1  |       1|None
1.3.6.1.2.1.4.20.1.4.169.254.0.1|       1|None
1.3.6.1.2.1.4.20.1.5.0.1.134.160|    1500|None
1.3.6.1.2.1.4.20.1.5.10.2.12.3  |    1500|None
1.3.6.1.2.1.4.20.1.5.10.10.0.3  |    1500|None
1.3.6.1.2.1.4.20.1.5.127.0.0.1  |    1500|None
1.3.6.1.2.1.4.20.1.5.169.254.0.1|    1500|None

 The IP is not found in the config.  The switches are running slightly different versions, including the most current  3.5.0.26.

How can I fix this?

Thank you.

0 Helpful
1 Accepted Solution

Accepted Solutions

Go to solution
Ingenieur
Level 1
Level 1

‎07-25-2025 04:28 AM - edited ‎07-25-2025 04:37 AM

Hello @efries_wy ,

I found the exact same IP address 0.1.134.160 /32 (or mask 255.255.255.255) presented through SNMP on several newer switches (CBS220 and C1200/C1300) just recently. It seems to be defined on vlan 1.
The corresponding interface seems to have index 100.000, name 1, description 1.

It's a reserved IP address and because of the prefix length of /32, it is a local loopback address which could be used for addressing an internal service. Though I don't know its purpose yet.

The number 100000 converted into the dotted decimal format is exactly the IP address 0.1.134.160, as can be seen for example in https://homepage.univie.ac.at/michael.poeltl/alt/py/ipaddress.html .

Interestingly the binary representation of the dotted decimal IP 0.1.134.160 is 00000000.00000001.10000110.10100000, which ends in 10100000.

Maybe some Cisco staff can shed some light into it?

View solution in original post

5 Replies 5

Go to solution
pieterh
VIP
VIP

‎07-16-2025 10:18 AM - edited ‎07-16-2025 10:48 AM

I have frequently used "snmpwalk"
I'm not familiar with "walkOid"  ->could  it be this tool is translating this oid incorretly ?

but looking at the other matching OID's (netmask), it looks like it could be a (self-administered?, internal?, loopback?) interface

oid                             |valueInt|valueString    
--------------------------------+--------+---------------
1.3.6.1.2.1.4.20.1.1.0.1.134.160|        |0.1.134.160
1.3.6.1.2.1.4.20.1.2.0.1.134.160|  100000|None
1.3.6.1.2.1.4.20.1.3.0.1.134.160|        |255.255.255.255 

 

0 Helpful

Go to solution
pieterh
VIP
VIP

‎07-23-2025 08:04 AM

you have not responded on my previous answer to your question, but i have another suggestion
SNMP also has a OID for interface names OID 1.3.6.1.2.1.31.1.1.1.1
if you snmpwalk that OID and search the interface with the same index (1 i guess), you may get an indication where this address is used for.

Module IF-MIB (CISCO)
Nom ifName
Acces readonly
Status current
Description The textual name of the interface. The value of this object should be the name of the interface as assigned by the local device and should be suitable for use in commands entered at the device's `console'. This might be a text name, such as `le0' or a simple port number, such as `1', depending on the interface naming syntax of the device. If several entries in the ifTable together represent a single interface as named by the device, then each will have the same value of ifName. Note that for an agent which responds to SNMP queries concerning an interface on some other (proxied) device, then the value of ifName for such an interface is the proxied device's local name for it. If there is no local name, or this object is otherwise not applicable, then this object contains a zero-length string.
Syntaxe DisplayString (SNMPv2-TC)

Go to solution
efries_wy
Level 1
Level 1

‎07-23-2025 02:44 PM - edited ‎07-23-2025 03:02 PM

Hi Pieter, 

Thank you for your reply, I appreciate the ideas and help.
Data from SNMP walk of OID 1.3.6.1.2.4.20 using a different tool is below.  Results look the same.  I don't believe it's a tool problem since that result is returned by 2 different SNMP Walk tests and a different SNMP monitoring application.  
I'm not an SNMP expert so there c/b something else amiss with SNMP but I'm not seeing it.

I ran the other test belwo, and I have attached a sanitized support output file from an SG350 switch, the issue is happening on both SG350 & CBS350. I'm happy to run other tests if an idea comes to mind.

Thank you.

Ed

=======================

7/23/2025 2:59:21 PM (23578 ms) : SNMP Datatype: ASN_COUNTER
Test 100047:48 (1.3.6.1.2.1.2.2.1.10.100047,1.3.6.1.2.1.2.2.1.16.100047): in=0 out=0
7/23/2025 2:59:21 PM (23592 ms) : SNMP Datatype: ASN_COUNTER
7/23/2025 2:59:21 PM (23600 ms) : SNMP Datatype: ASN_COUNTER
Test 100099:100 (1.3.6.1.2.1.2.2.1.10.100099,1.3.6.1.2.1.2.2.1.16.100099): in=0 out=0
7/23/2025 2:59:21 PM (23613 ms) : SNMP Datatype: ASN_COUNTER
7/23/2025 2:59:21 PM (23622 ms) : SNMP Datatype: ASN_COUNTER
Test 100131:132 (1.3.6.1.2.1.2.2.1.10.100131,1.3.6.1.2.1.2.2.1.16.100131): in=0 out=0
7/23/2025 2:59:21 PM (23635 ms) : SNMP Datatype: ASN_COUNTER
7/23/2025 2:59:21 PM (23643 ms) : SNMP Datatype: ASN_COUNTER
Test 100163:164 (1.3.6.1.2.1.2.2.1.10.100163,1.3.6.1.2.1.2.2.1.16.100163): in=0 out=0
7/23/2025 2:59:21 PM (23657 ms) : SNMP Datatype: ASN_COUNTER
7/23/2025 2:59:21 PM (23664 ms) : SNMP Datatype: ASN_COUNTER
Test 100191:192 (1.3.6.1.2.1.2.2.1.10.100191,1.3.6.1.2.1.2.2.1.16.100191): in=0 out=0

----------------------- New Test -----------------------
Paessler SNMP Tester - 24.4.102.648 Computername: SERVHOST-23 Interface: 10.10.0.25
7/23/2025 3:01:58 PM (18 ms) : Device: 10.10.0.4
7/23/2025 3:01:58 PM (22 ms) : SNMP v1
7/23/2025 3:01:58 PM (26 ms) : Walk 1.3.6.1.2.1.4.20
7/23/2025 3:01:58 PM (34 ms) : 1.3.6.1.2.1.4.20.1.1.0.1.134.160 = "0.1.134.160" [ASN_IPADDRESS]
7/23/2025 3:01:58 PM (41 ms) : 1.3.6.1.2.1.4.20.1.1.10.2.12.4 = "10.2.12.4" [ASN_IPADDRESS]
7/23/2025 3:01:58 PM (48 ms) : 1.3.6.1.2.1.4.20.1.1.10.10.0.4 = "10.10.0.4" [ASN_IPADDRESS]
7/23/2025 3:01:58 PM (57 ms) : 1.3.6.1.2.1.4.20.1.1.127.0.0.1 = "127.0.0.1" [ASN_IPADDRESS]
7/23/2025 3:01:58 PM (65 ms) : 1.3.6.1.2.1.4.20.1.1.169.254.0.1 = "169.254.0.1" [ASN_IPADDRESS]
7/23/2025 3:01:58 PM (75 ms) : 1.3.6.1.2.1.4.20.1.2.0.1.134.160 = "100000" [ASN_INTEGER]
7/23/2025 3:01:58 PM (82 ms) : 1.3.6.1.2.1.4.20.1.2.10.2.12.4 = "100011" [ASN_INTEGER]
7/23/2025 3:01:58 PM (89 ms) : 1.3.6.1.2.1.4.20.1.2.10.10.0.4 = "100019" [ASN_INTEGER]
7/23/2025 3:01:58 PM (97 ms) : 1.3.6.1.2.1.4.20.1.2.127.0.0.1 = "20000" [ASN_INTEGER]
7/23/2025 3:01:58 PM (104 ms) : 1.3.6.1.2.1.4.20.1.2.169.254.0.1 = "8000" [ASN_INTEGER]
7/23/2025 3:01:58 PM (112 ms) : 1.3.6.1.2.1.4.20.1.3.0.1.134.160 = "255.255.255.255" [ASN_IPADDRESS]
7/23/2025 3:01:58 PM (118 ms) : 1.3.6.1.2.1.4.20.1.3.10.2.12.4 = "255.255.255.0" [ASN_IPADDRESS]
7/23/2025 3:01:58 PM (125 ms) : 1.3.6.1.2.1.4.20.1.3.10.10.0.4 = "255.255.254.0" [ASN_IPADDRESS]
7/23/2025 3:01:58 PM (132 ms) : 1.3.6.1.2.1.4.20.1.3.127.0.0.1 = "0.0.0.0" [ASN_IPADDRESS]
7/23/2025 3:01:58 PM (139 ms) : 1.3.6.1.2.1.4.20.1.3.169.254.0.1 = "255.255.255.0" [ASN_IPADDRESS]
7/23/2025 3:01:58 PM (146 ms) : 1.3.6.1.2.1.4.20.1.4.0.1.134.160 = "1" [ASN_INTEGER]
7/23/2025 3:01:58 PM (153 ms) : 1.3.6.1.2.1.4.20.1.4.10.2.12.4 = "1" [ASN_INTEGER]
7/23/2025 3:01:58 PM (160 ms) : 1.3.6.1.2.1.4.20.1.4.10.10.0.4 = "1" [ASN_INTEGER]
7/23/2025 3:01:58 PM (167 ms) : 1.3.6.1.2.1.4.20.1.4.127.0.0.1 = "1" [ASN_INTEGER]
7/23/2025 3:01:58 PM (174 ms) : 1.3.6.1.2.1.4.20.1.4.169.254.0.1 = "1" [ASN_INTEGER]
7/23/2025 3:01:58 PM (182 ms) : 1.3.6.1.2.1.4.20.1.5.0.1.134.160 = "1500" [ASN_INTEGER]
7/23/2025 3:01:58 PM (188 ms) : 1.3.6.1.2.1.4.20.1.5.10.2.12.4 = "1500" [ASN_INTEGER]
7/23/2025 3:01:58 PM (195 ms) : 1.3.6.1.2.1.4.20.1.5.10.10.0.4 = "1500" [ASN_INTEGER]
7/23/2025 3:01:58 PM (202 ms) : 1.3.6.1.2.1.4.20.1.5.127.0.0.1 = "1500" [ASN_INTEGER]
7/23/2025 3:01:58 PM (209 ms) : 1.3.6.1.2.1.4.20.1.5.169.254.0.1 = "1500" [ASN_INTEGER]

========================

========================

SNMP Walk of OID 1.3.6.1.2.1.31.1.1.1.1 is below.  I had good hopes for this idea but unfortunately the string 0.1.134.160 is not listed.

----------------------- New Test -----------------------
Paessler SNMP Tester - 24.4.102.648 Computername: SERVHOST-23 Interface: 10.10.0.25
7/23/2025 3:11:08 PM (3 ms) : Device: 10.10.0.4
7/23/2025 3:11:08 PM (8 ms) : SNMP v1
7/23/2025 3:11:08 PM (12 ms) : Walk 1.3.6.1.2.1.31.1.1.1.1
7/23/2025 3:11:08 PM (21 ms) : 1.3.6.1.2.1.31.1.1.1.1.1 = "gi1" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (30 ms) : 1.3.6.1.2.1.31.1.1.1.1.2 = "gi2" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (36 ms) : 1.3.6.1.2.1.31.1.1.1.1.3 = "gi3" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (42 ms) : 1.3.6.1.2.1.31.1.1.1.1.4 = "gi4" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (54 ms) : 1.3.6.1.2.1.31.1.1.1.1.5 = "gi5" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (61 ms) : 1.3.6.1.2.1.31.1.1.1.1.6 = "gi6" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (68 ms) : 1.3.6.1.2.1.31.1.1.1.1.7 = "gi7" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (75 ms) : 1.3.6.1.2.1.31.1.1.1.1.8 = "gi8" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (82 ms) : 1.3.6.1.2.1.31.1.1.1.1.9 = "gi9" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (92 ms) : 1.3.6.1.2.1.31.1.1.1.1.10 = "gi10" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (99 ms) : 1.3.6.1.2.1.31.1.1.1.1.11 = "gi11" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (105 ms) : 1.3.6.1.2.1.31.1.1.1.1.12 = "gi12" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (112 ms) : 1.3.6.1.2.1.31.1.1.1.1.13 = "gi13" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (119 ms) : 1.3.6.1.2.1.31.1.1.1.1.14 = "gi14" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (125 ms) : 1.3.6.1.2.1.31.1.1.1.1.15 = "gi15" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (133 ms) : 1.3.6.1.2.1.31.1.1.1.1.16 = "gi16" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (140 ms) : 1.3.6.1.2.1.31.1.1.1.1.17 = "gi17" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (147 ms) : 1.3.6.1.2.1.31.1.1.1.1.18 = "gi18" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (154 ms) : 1.3.6.1.2.1.31.1.1.1.1.19 = "gi19" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (161 ms) : 1.3.6.1.2.1.31.1.1.1.1.20 = "gi20" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (168 ms) : 1.3.6.1.2.1.31.1.1.1.1.21 = "gi21" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (179 ms) : 1.3.6.1.2.1.31.1.1.1.1.22 = "gi22" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (187 ms) : 1.3.6.1.2.1.31.1.1.1.1.23 = "gi23" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (194 ms) : 1.3.6.1.2.1.31.1.1.1.1.24 = "gi24" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (202 ms) : 1.3.6.1.2.1.31.1.1.1.1.25 = "gi25" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (209 ms) : 1.3.6.1.2.1.31.1.1.1.1.26 = "gi26" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (217 ms) : 1.3.6.1.2.1.31.1.1.1.1.27 = "gi27" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (225 ms) : 1.3.6.1.2.1.31.1.1.1.1.28 = "gi28" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (233 ms) : 1.3.6.1.2.1.31.1.1.1.1.1000 = "Po1" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (240 ms) : 1.3.6.1.2.1.31.1.1.1.1.1001 = "Po2" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (247 ms) : 1.3.6.1.2.1.31.1.1.1.1.1002 = "Po3" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (253 ms) : 1.3.6.1.2.1.31.1.1.1.1.1003 = "Po4" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (260 ms) : 1.3.6.1.2.1.31.1.1.1.1.1004 = "Po5" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (268 ms) : 1.3.6.1.2.1.31.1.1.1.1.1005 = "Po6" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (274 ms) : 1.3.6.1.2.1.31.1.1.1.1.1006 = "Po7" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (281 ms) : 1.3.6.1.2.1.31.1.1.1.1.1007 = "Po8" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (289 ms) : 1.3.6.1.2.1.31.1.1.1.1.3000 = "tunnel1" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (297 ms) : 1.3.6.1.2.1.31.1.1.1.1.7000 = "loopback1" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (306 ms) : 1.3.6.1.2.1.31.1.1.1.1.8000 = "User Defined Port 1" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (313 ms) : 1.3.6.1.2.1.31.1.1.1.1.9000 = "stack-port" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (319 ms) : 1.3.6.1.2.1.31.1.1.1.1.20000 = "Logical-int 1" [ASN_OCTET_STR]
7/23/2025 3:11:08 PM (328 ms) : 1.3.6.1.2.1.31.1.1.1.1.100000 = "1" [ASN_OCTET_STR]

SG350_TechSupportInfo_Sanitized_250723.txt
0 Helpful

Go to solution
Ingenieur
Level 1
Level 1

‎07-25-2025 04:28 AM - edited ‎07-25-2025 04:37 AM

Hello @efries_wy ,

I found the exact same IP address 0.1.134.160 /32 (or mask 255.255.255.255) presented through SNMP on several newer switches (CBS220 and C1200/C1300) just recently. It seems to be defined on vlan 1.
The corresponding interface seems to have index 100.000, name 1, description 1.

It's a reserved IP address and because of the prefix length of /32, it is a local loopback address which could be used for addressing an internal service. Though I don't know its purpose yet.

The number 100000 converted into the dotted decimal format is exactly the IP address 0.1.134.160, as can be seen for example in https://homepage.univie.ac.at/michael.poeltl/alt/py/ipaddress.html .

Interestingly the binary representation of the dotted decimal IP 0.1.134.160 is 00000000.00000001.10000110.10100000, which ends in 10100000.

Maybe some Cisco staff can shed some light into it?

Go to solution
efries_wy
Level 1
Level 1

‎07-25-2025 09:46 AM

Wow, nice find and good to know it's not something in our configuration.  It's a bit annoying because it shows up in our NMS as an IP interface so it would be nice if that could be changed.

0 Helpful
Customers Also Viewed These Support Documents