Solved: Re: SRW2048 - UPnP Errors

JensWeibler · ‎04-09-2011

Hi,

since a few days my srw2048 are flodding my logs (one week: 119.229 for about 40 switches):

%UPNP-W-DBOVERFLOW: UPnP retransmission DB overflow.#015

What does that message mean? How can I fix it?

nimusell · ‎04-12-2011

Hi Jens,

Thank you for the log. As you indicated, you have a large network with a lot of devices.

The SRW device has an internal memory pool that keeps UPnP messages for retransmission. 
The %UPNP-W-DBOVERFLOW: UPnP retransmission DB overflow messages indicate that this memory pool has been exhausted.

This scenario might occur in networks with lots of UPnP devices and many UPnP control points each requesting UPnP reports from the SRW device.
For example if you have a network with many PCs running Win XP and UPnP UI installed, the device might get many queries and utilize 100% of this
memory pool.

As far as we can see, the behavior is as designed - overflow occurs when too many messages are received within a short period of time.
There is no memory leak, and after the en-queued messages were handled, new requests are accepted by the device.

To summarize, these log messages are normal and do not adversely affect the performance of the switch. 
The switch should continue to filter and forward frames as configured.

However, you could verify whether all this UPnP traffic is necessary on the network and eventually reconfigure the hosts generating it.

Please let me know if you have any other questions.

Best regards,

Nico Muselle

Sr. Network Engineer - CCNA

View solution in original post

nimusell · ‎04-11-2011

Hello Jens,

Thank you for participating in the Small Business support community. My name is Nico Muselle from Cisco Sofia SBSC.

These log messages mean that some device in your network is flooding broadcast UPnP messages over the switches in such a way that the switch(es) doesn't (don't) have time to handle all of them, thus an overflow occurs.

Going back to the moment these messages started to appear, has anything changed on the network, has any device been added at that moment that could have caused this UPnP flooding ? The easiest way to solve this is if you know where the traffic is generated and configure this particular device in such a way that it stops flooding the network with UPnP packets.

If you don't know what device causes it, the best thing to do is to monitor the network traffic for UPnP messages using Wireshark and determine there what is the source IP of these packets, to be able to put a halt to it. This way, you could also decide what is the destination multicast IP address and eventually implement an ACL on the source port to block this traffic if you cannot turn it of on the device causing it.

Hope this helped,

Best regards,

Nico Muselle

Sr. Network Engineer - CCNA

JensWeibler · ‎04-11-2011

Hello Nico,

the change is simple: we've changed the backbone from Summit to Cisco

But the network is large and it could also be another cause...

Now the message appears every few minutes:

11-Apr-2011 16:49:56 %UPNP-W-DBOVERFLOW: UPnP retransmission DB overflow.
11-Apr-2011 16:51:20 %UPNP-W-DBOVERFLOW: UPnP retransmission DB overflow.
11-Apr-2011 16:51:25 %UPNP-W-DBOVERFLOW: UPnP retransmission DB overflow.

I've monitored the connection to one Linksys and the six SSDP-packets before the syslog packet (DB-Overflow) are all from the same switch!

No.     Time        Source                Destination           Protocol Info
    101 205.360290  141.100.45.144        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    105 205.701177  141.100.45.144        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    106 206.385191  141.100.45.144        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    107 206.539223  141.100.45.144        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    108 206.916588  141.100.45.144        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    115 207.303573  141.100.56.155        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    118 207.402520  141.100.56.155        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    119 207.502300  141.100.56.155        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    121 207.668939  141.100.56.151        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    122 207.669066  141.100.56.151        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    129 207.868867  141.100.56.151        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    130 207.868985  141.100.56.151        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    139 208.132214  141.100.45.144        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    142 208.701495  141.100.45.144        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    153 209.539849  141.100.45.144        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    157 209.933810  141.100.45.144        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    158 210.149266  141.100.56.134        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    160 210.349201  141.100.56.134        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    162 211.032589  141.100.56.153        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    163 211.155807  141.100.45.144        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    164 211.358384  141.100.45.144        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    166 211.722344  141.100.45.144        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    188 217.398020  141.100.56.155        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    190 218.435290  141.100.56.154        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    191 218.534035  141.100.56.154        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    192 218.634133  141.100.56.154        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    216 221.774000  141.100.56.150        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    217 221.829395  141.100.56.149        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    218 221.872692  141.100.56.150        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    219 221.875238  141.100.41.6          239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    221 221.928149  141.100.56.149        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    222 221.972684  141.100.56.150        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    223 222.028106  141.100.56.149        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    229 224.885628  141.100.41.6          239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    242 226.683579  141.100.56.132        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    243 226.764922  192.168.95.49         239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    244 226.782607  141.100.56.132        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    245 226.882258  141.100.56.132        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    248 227.896089  141.100.41.6          239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    250 228.529551  141.100.56.154        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    256 228.727646  141.100.56.140        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    257 228.729795  141.100.56.154        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    258 228.826343  141.100.56.140        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    259 228.926323  141.100.56.140        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    263 229.265237  141.100.59.245        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    273 230.920195  141.100.41.6          239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    276 231.868136  141.100.56.150        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    277 231.923627  141.100.56.149        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    278 232.068015  141.100.56.150        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    286 233.917088  141.100.41.6          239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    312 236.412717  141.100.56.158        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    314 236.511372  141.100.56.158        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    316 236.611358  141.100.56.158        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    317 236.777669  141.100.56.132        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    318 236.927583  141.100.41.6          239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    319 236.977586  141.100.56.132        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    324 238.821678  141.100.56.140        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    371 242.882012  141.100.56.131        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    372 242.980577  141.100.56.131        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    374 243.080575  141.100.56.131        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    375 243.091859  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    395 246.090028  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    396 246.506784  141.100.56.158        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    406 249.091234  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    413 252.135855  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    419 252.976015  141.100.56.131        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    442 254.593505  141.100.56.159        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    450 254.692154  141.100.56.159        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    463 254.792126  141.100.56.159        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    470 255.136829  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    471 255.154779  141.100.56.163        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    475 255.253509  141.100.56.163        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    476 255.353435  141.100.56.163        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    481 256.762488  192.168.95.49         239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    486 258.135885  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    494 259.262393  141.100.59.245        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    530 264.687474  141.100.56.159        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    532 265.248810  141.100.56.163        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    536 266.838463  141.100.56.162        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    537 266.937156  141.100.56.162        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    538 267.037133  141.100.56.162        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    600 271.621663  141.100.56.152        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    601 271.720418  141.100.56.152        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    602 271.820393  141.100.56.152        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    614 276.683415  141.100.56.146        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    615 276.782179  141.100.56.146        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    616 276.882061  141.100.56.146        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    617 276.932588  141.100.56.162        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    621 278.696584  141.100.56.145        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    622 278.795278  141.100.56.145        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    623 278.855046  141.100.56.147        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    624 278.895271  141.100.56.145        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    625 278.958770  141.100.56.147        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    626 279.056438  141.100.56.147        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    666 281.715772  141.100.56.152        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    723 286.760054  192.168.95.49         239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    724 286.777460  141.100.56.146        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    725 286.977568  141.100.56.146        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    732 288.790670  141.100.56.145        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    733 288.954103  141.100.56.147        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    735 289.259514  141.100.59.245        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    742 290.671463  141.100.45.144        239.255.255.250       UDP      Source port: 51902  Destination port: ws-discovery
    743 290.951295  141.100.45.144        239.255.255.250       UDP      Source port: 51902  Destination port: ws-discovery
    744 290.952049  141.100.45.144        239.255.255.250       UDP      Source port: 51902  Destination port: ws-discovery
    746 291.139758  141.100.45.144        239.255.255.250       UDP      Source port: 51902  Destination port: ws-discovery
    748 291.253799  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    761 293.812719  141.100.56.148        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    762 293.852781  141.100.51.36         239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    764 293.911240  141.100.56.148        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    766 294.011436  141.100.56.148        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    779 294.254634  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    787 295.854701  141.100.51.36         239.255.255.250       UDP      Source port: 50523  Destination port: ws-discovery
    788 295.877546  141.100.51.36         239.255.255.250       UDP      Source port: 50523  Destination port: ws-discovery
    790 296.053962  141.100.51.36         239.255.255.250       UDP      Source port: 50523  Destination port: ws-discovery
    791 296.059235  141.100.51.36         239.255.255.250       UDP      Source port: 50523  Destination port: ws-discovery
    792 296.083245  141.100.51.36         239.255.255.250       UDP      Source port: 50523  Destination port: ws-discovery
    793 296.305851  141.100.51.36         239.255.255.250       UDP      Source port: 50523  Destination port: ws-discovery
    797 296.836563  141.100.51.36         239.255.255.250       UDP      Source port: 50523  Destination port: ws-discovery
    798 296.863173  141.100.51.36         239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    800 296.936697  141.100.51.36         239.255.255.250       UDP      Source port: 50523  Destination port: ws-discovery
    804 297.254320  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    815 299.862156  141.100.51.36         239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    832 300.283348  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    844 302.861998  141.100.51.36         239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    846 303.290189  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    847 303.906743  141.100.56.148        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    854 305.842704  141.100.56.161        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    855 305.941448  141.100.56.161        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    856 306.041413  141.100.56.161        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    858 306.290111  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    867 309.057335  141.100.66.230        239.255.255.250       IGMP     V1 Membership Report
    870 309.319573  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    877 312.326966  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    886 313.546432  141.100.56.164        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    887 313.645750  141.100.56.164        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    888 313.745170  141.100.56.164        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    913 315.332112  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
    916 315.936973  141.100.56.161        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    917 316.136806  141.100.56.161        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    923 316.757573  192.168.95.49         239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    933 319.256525  141.100.59.245        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    961 323.640702  141.100.56.164        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    969 324.652615  141.100.56.135        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    970 324.751275  141.100.56.135        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    971 324.851151  141.100.56.135        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    982 327.831707  141.100.56.137        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    983 327.930281  141.100.56.137        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
    986 328.030262  141.100.56.137        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   1011 334.746697  141.100.56.135        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   1044 337.925554  141.100.56.137        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   1045 338.125423  141.100.56.137        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   1054 339.455847  141.100.56.165        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   1055 339.554570  141.100.56.165        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   1056 339.654529  141.100.56.165        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   1356 343.476047  141.100.56.151        141.100.56.1          Syslog   LOCAL7.INFO: %AAA-I-CONNECT: User CLI session for user admin over ssh , source 141.100.45.184 destination  0.0.0.0 ACCEPTED\r\n
   1427 343.909078  141.100.56.151        141.100.56.1          Syslog   LOCAL7.INFO: %AAA-I-DISCONNECT: User CLI session for user admin over ssh , source 141.100.45.184 destination  0.0.0.0  TERMINATED. The Telnet/SSH session may still be connected.\r\n
   1589 346.755156  192.168.95.49         239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   1602 349.253658  141.100.59.245        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   1625 349.553338  141.100.56.165        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   1729 351.804673  141.100.56.151        141.100.56.1          Syslog   LOCAL7.INFO: %AAA-I-CONNECT: User CLI session for user admin over ssh , source 141.100.45.184 destination  141.100.56.151 ACCEPTED\r\n
   1824 356.003044  141.100.45.144        239.255.255.250       UDP      Source port: 51902  Destination port: ws-discovery
   1825 356.127434  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
   1835 359.127108  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
   1855 362.127264  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
   1866 365.237880  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
   1877 368.235508  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
   1882 369.122688  141.100.51.36         239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
   1883 369.123106  141.100.51.36         239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
   1892 370.642313  141.100.56.129        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   1893 370.740856  141.100.56.129        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   1895 370.840903  141.100.56.129        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   1897 371.232749  141.100.45.144        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
   1920 372.122675  141.100.51.36         239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
   1921 372.122880  141.100.51.36         239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
   1983 375.122409  141.100.51.36         239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
   1984 375.122617  141.100.51.36         239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
   2159 376.752671  192.168.95.49         239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   2168 379.250746  141.100.59.245        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   2191 380.736276  141.100.56.129        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   2192 380.936203  141.100.56.129        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   3752 390.344300  141.100.56.160        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   3760 390.443013  141.100.56.160        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   3763 390.542998  141.100.56.160        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   3809 400.438399  141.100.56.160        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   3833 406.750251  192.168.95.49         239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   3846 409.247825  141.100.59.245        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4174 436.005987  141.100.66.230        239.255.255.250       IGMP     V1 Membership Report
   4184 436.747788  192.168.95.49         239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4193 439.244954  141.100.59.245        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4283 453.051624  141.100.51.129        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
   4285 453.095653  141.100.51.129        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
   4286 453.243196  141.100.51.129        239.255.255.250       UDP      Source port: 62803  Destination port: ws-discovery
   4287 453.468219  141.100.51.129        239.255.255.250       UDP      Source port: 62803  Destination port: ws-discovery
   4292 456.057690  141.100.51.129        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
   4294 456.104440  141.100.51.129        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
   4307 459.068319  141.100.51.129        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
   4309 459.115023  141.100.51.129        239.255.255.250       SSDP     M-SEARCH * HTTP/1.1 
   4348 466.745363  192.168.95.49         239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4358 469.242065  141.100.59.245        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4362 470.133310  141.100.56.144        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4363 470.232108  141.100.56.144        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4364 470.332072  141.100.56.144        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4370 471.710112  141.100.56.141        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4373 471.808848  141.100.56.141        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4382 471.908798  141.100.56.141        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4396 472.742651  141.100.56.142        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4398 472.841391  141.100.56.142        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4400 472.941362  141.100.56.142        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4572 477.966532  141.100.56.143        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4573 478.065229  141.100.56.143        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4574 478.165196  141.100.56.143        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4582 478.535704  141.100.56.133        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4584 478.634316  141.100.56.133        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4585 478.734285  141.100.56.133        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4600 480.227454  141.100.56.144        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4604 480.427356  141.100.56.144        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4609 481.500188  141.100.56.139        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4610 481.595498  141.100.56.139        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4611 481.694561  141.100.56.139        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4612 481.804233  141.100.56.141        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4615 482.836765  141.100.56.142        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4616 482.866500  141.100.56.156        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4618 482.965191  141.100.56.156        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4619 483.065187  141.100.56.156        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4620 483.096820  141.100.56.157        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4621 483.195569  141.100.56.157        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4622 483.295541  141.100.56.157        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4651 488.060591  141.100.56.143        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4652 488.260502  141.100.56.143        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4654 488.629678  141.100.56.133        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4669 490.766789  141.100.56.130        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4670 490.865536  141.100.56.130        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4671 490.965614  141.100.56.130        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4674 491.590907  141.100.56.139        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4680 492.960616  141.100.56.156        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4681 493.190906  141.100.56.157        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4682 493.390803  141.100.56.157        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4707 496.742904  192.168.95.49         239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4710 497.733654  141.100.56.151        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4711 497.734934  141.100.56.151        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4717 497.833468  141.100.56.151        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4718 497.833590  141.100.56.151        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4721 497.933445  141.100.56.151        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4722 497.933570  141.100.56.151        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4723 497.954451  141.100.56.151        141.100.56.1          Syslog   LOCAL7.WARNING: %UPNP-W-DBOVERFLOW: UPnP retransmission DB overflow.\r\n
   4739 499.239144  141.100.59.245        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4755 500.217702  141.100.56.134        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4757 500.316429  141.100.56.134        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4761 500.416633  141.100.56.134        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4765 500.860867  141.100.56.130        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4767 501.099394  141.100.56.153        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4769 501.198067  141.100.56.153        239.255.255.250       SSDP     NOTIFY * HTTP/1.1 
   4770 501.298035  141.100.56.153        239.255.255.250       SSDP     NOTIFY * HTTP/1.1

nimusell · ‎04-12-2011

Hi Jens,

Thank you for the log. As you indicated, you have a large network with a lot of devices.

The SRW device has an internal memory pool that keeps UPnP messages for retransmission. 
The %UPNP-W-DBOVERFLOW: UPnP retransmission DB overflow messages indicate that this memory pool has been exhausted.

This scenario might occur in networks with lots of UPnP devices and many UPnP control points each requesting UPnP reports from the SRW device.
For example if you have a network with many PCs running Win XP and UPnP UI installed, the device might get many queries and utilize 100% of this
memory pool.

As far as we can see, the behavior is as designed - overflow occurs when too many messages are received within a short period of time.
There is no memory leak, and after the en-queued messages were handled, new requests are accepted by the device.

To summarize, these log messages are normal and do not adversely affect the performance of the switch. 
The switch should continue to filter and forward frames as configured.

However, you could verify whether all this UPnP traffic is necessary on the network and eventually reconfigure the hosts generating it.

Please let me know if you have any other questions.

Best regards,

Nico Muselle

Sr. Network Engineer - CCNA

JensWeibler · ‎04-12-2011

ok, thank you - I'll filter the log entries

nimusell · ‎04-13-2011

Welcome Jens, glad I could clarify this for you

Regards,

Nico

dlevine · ‎11-02-2011

Nico - since you were able to clarify things for Jens, please allow me to humbly ask for a bit of additional clarification as well...

What Jens is experiencing seems to be the same thing that we've suffered with at my office for a few years now (~2008), and has plagued many others going back even further (2006).

Please see these two links:

https://supportforums.cisco.com/message/3104089#3104089

http://homecommunity.cisco.com/t5/Switches/SRW2024-Log-message-Gen-Troubleshooting/td-p/15279

I have two small problems with your answer though:

The SRW device has an internal memory pool that keeps UPnP messages for retransmission.

The %UPNP-W-DBOVERFLOW: UPnP retransmission DB overflow messages indicate that this memory pool has been exhausted.

This scenario might occur in networks with lots of UPnP devices and many UPnP control points each requesting UPnP reports from the SRW device.

For example if you have a network with many PCs running Win XP and UPnP UI installed, the device might get many queries and utilize 100% of this

memory pool.

In my office, we only have 30 computers, 6 printers, a router and a firewall, yet this issue has been a chronic problem for us. I've disabled UPnP on all of the peripherals, but with the way that things have progressed in Windows from XP to Vista to 7, disabling UPnP on the workstations is becoming less of an option because functionality is beginning to depend on it, like Network Discovery. Didn't need UPnP for years to see the whole network in Windows, now the two go hand-in-hand, but that's a complaint for a different company though. Is 30-40 devices enough to be considered "lots of UPnP devices and many UPnP control points"?

As far as we can see, the behavior is as designed - overflow occurs when too many messages are received within a short period of time.

There is no memory leak, and after the en-queued messages were handled, new requests are accepted by the device.

To summarize, these log messages are normal and do not adversely affect the performance of the switch.

The switch should continue to filter and forward frames as configured.

I think that when I called Cisco about this problem a few years back they said the same thing, and I accepted it, but later found that this was most definitely not the case. What actually happens is that once the buffer overflows, the switch struggles to keep up and gradually runs out of memory, starts having issues correctly processing legitimate non-UPnP traffic (leading to users complaining about slow logins, dropped database connections, corrupted print jobs, and any number of other issues). Rebooting the switch inevitably seems to "fix" the problem, because it forces the buffer to reset and dumps the pending queue, thus giving the switch a "clean-slate" and allowing it to focus on the real traffic... while UPnP starts backing up again... Or, at least that's how it behaves in my office - here's a log excerpt from just a little bit ago:

	Log Index	Log Time	Severity	Description
1	2147416320	02-Nov-2011 17:55:31	Informational	%AAA-I-CONNECT: New http connection for user admin, source 192.168.16.73 destination 192.168.16.145 ACCEPTED
2	2147416321	02-Nov-2011 17:53:40	Warning	%UPNP-W-DBOVERFLOW: UPnP retransmission DB overflow.
3	2147416322	02-Nov-2011 17:53:40	Debug	%OS-D-MEMORY: No free memory: size = 364, pool = UPnP, task = UPNP
4	2147416323	02-Nov-2011 17:53:40	Warning	%UPNP-W-DBOVERFLOW: UPnP retransmission DB overflow.
5	2147416324	02-Nov-2011 17:53:40	Debug	%OS-D-MEMORY: No free memory: size = 340, pool = UPnP, task = UPNP
6	2147416325	02-Nov-2011 17:48:42	Warning	%UPNP-W-DBOVERFLOW: UPnP retransmission DB overflow.
7	2147416326	02-Nov-2011 17:48:42	Debug	%OS-D-MEMORY: No free memory: size = 364, pool = UPnP, task = UPNP
8	2147416327	02-Nov-2011 17:48:42	Warning	%UPNP-W-DBOVERFLOW: UPnP retransmission DB overflow.
9	2147416328	02-Nov-2011 17:48:42	Debug	%OS-D-MEMORY: No free memory: size = 340, pool = UPnP, task = UPNP
10	2147416329	02-Nov-2011 17:43:42	Warning	%UPNP-W-DBOVERFLOW: UPnP retransmission DB overflow.
11	2147416330	02-Nov-2011 17:43:42	Debug	%OS-D-MEMORY: No free memory: size = 364, pool = UPnP, task = UPNP
12	2147416331	02-Nov-2011 17:43:41	Warning	%UPNP-W-DBOVERFLOW: UPnP retransmission DB overflow.


However, you could verify whether all this UPnP traffic is necessary on the network and eventually reconfigure the hosts generating it.
Please let me know if you have any other questions.

I have a few follow-up questions/suggestions, if you don't mind:

The first is obvious - how do I make it stop? Power-cycling it every few months to reset it is really getting old and, arguably, shouldn't be necessary - even you said it should keep working fine and the errors can be safely ignored. I can't kill UPnP/SSDP on my Windows boxes because, well, it's pretty much part of Windows now. Plus, doing so really shouldn't be any more necessary than power-cycling it - why doesn't it handle UPnP traffic the same way it handles everything else that broad/multicasts?

When I called in about this issue, the tech (it took several before anyone had any idea what the errors meant) said to use WireShark to figure out where the UPnP broadcasts were coming from and disable it on that device, or create an ACL to block it at the switch, which is essentially the same answer you gave. I don't really have time to capture and process and sniff around to find the culprit - how would I go about creating an ACL to block all UPnP traffic from entering the switch (but not kill all other broadcast traffic)? I can't tell you how much I'd appreciate it if you could give me just that small bit of information (and ideally add it to the knowledge base for everyone else who's tired of this problem to refer to)...

I tried to figure it out - went to the ACL tab, made an IP-based ACL, Deny TCP Any 5000 Any Any, Deny UDP Any 1900 Any Any, but it doesn't seem to be doing anything at all.

I *really* hope you can help me put the final nail in this issue's coffin once and for all - I just received a brand new SRW2048 today to add to our network - unfortunately I assumed that new manufacturer/new hardware would have fixed this old headache.

Any help you can provide would be immensely appreciated. Thanks in advance.