Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About ronwagner
Stats
Member since
11-04-2004
14
Posts
0
Helpful
0
Solutions
08-09-2019
04:35 AM
Thanks Reza Sharifi for the link. Sort of what I had found before opening a TAC case. TAC keeps asking for more data, but has not come back saying that it is not possible to log to syslog. Somewhere I found something about a 25 log compressed limit and there was a hard limit of 1 meg for the "running" logs before they are compress and filed. The "request platform software trace archive ...... target" does not allow for an "off device" target such as FTP/TFTP/SCP etc. at least on the code we are running. But I also see with the TAC case that this command is in flux with different versions of IOS. Link to limits, on page 2 under "tracelog size limit and rotation policy": https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/16-1/command_reference/b_161_consolidated_3850_cr/b_161_consolidated_3850_cr_chapter_010100.pdf
... View more
08-07-2019
07:50 AM
I am in need of running debug for a long time (several days). I found where the new Denali code uses set platform software trace commands for debug of RADIUS and dot1x. Did the set commands, and can see debug messages via show platform software trace command. However, I cannot get those messages to log to a syslog server. I can get the "classic debug" for debug cdp to log to syslog, but not the set commands messages. TAC is working with me, but am hoping someone in the community can get me an answer sooner. 1) Does the new set commands support logging to syslog? 2) Is there a command that needs to be used to get the set platform command messages to log to syslog? TIA
... View more
Labels:
12-22-2017
04:42 AM
We use various tools and scripts to watch the network to make sure things don't change "mysteriously" (aka nefariously). Ran into something the other day that we cannot locate an answer for.
We upgrade IOS on a 3650 and a PID changed on the sh inv display. It is a single device and the serial numbers did not change. It is the PID for the stack, so maybe it changed because of a stack change in the past on the device, but we don't think so. What ever the cause, we would like to know why, and understand how, the PID changed. [WS-C3650-24PDM changed to WS-C3650-24PDM-S]
sh ver
<snip>
Switch Ports Model SW Version SW Image Mode ------ ----- ----- ---------- ---------- ---- * 1 28 WS-C3650-24PDM 16.3.1 CAT3K_CAA-UNIVERSALK9 INSTALL
<snip>
sh inv NAME: "c36xx Stack", DESCR: "c36xx Stack" PID: WS-C3650-24PDM , VID: V01 , SN: FDO2033V0C7
NAME: "Switch 1", DESCR: "WS-C3650-24PDM-S" PID: WS-C3650-24PDM-S , VID: V01 , SN: FDO2033V0C7
<snip>
sh ver
<snip>
Switch Ports Model SW Version SW Image Mode ------ ----- ----- ---------- ---------- ---- * 1 28 WS-C3650-24PDM 16.3.5b CAT3K_CAA-UNIVERSALK9 INSTALL
<snip>
sh inv NAME: "c36xx Stack", DESCR: "c36xx Stack" PID: WS-C3650-24PDM-S , VID: V01 , SN: FDO2033V0C7
NAME: "Switch 1", DESCR: "WS-C3650-24PDM-S" PID: WS-C3650-24PDM-S , VID: V01 , SN: FDO2033V0C7
<snip>
... View more
Labels:
07-05-2013
05:14 AM
Thank you both for the information. Ivan, do you know if the message is the same message as mentioned in Inayath comment.........-LOW_BATT: Low Voltage detected for NVRAM Battery ? I presume this will be in syslogs, providing the switches' configuration is setup appropriately. Do you know what log level the message would be? Thanks, Ron
... View more
07-04-2013
09:37 AM
Cisco appears to use a lithium battery for holding NVRAM (as opposed to some type of EEPROM or flash technology which they used in generations past). My observations are that the battery can go bad and cause undesirable things like booting into ROMMON after a power cycle and/or fully corrupted NVRAM. Although I have only observed this on cat 6500, I anticipate that the cat 4500, and Nexus series can encounter similar problems. Not sure about smaller switches, haven't taken a hammer and screwdriver to them yet. Is there a way to display the voltage of the lithium battery on supervisor engines? Oh and if so how
... View more
Labels:
11-29-2012
05:36 AM
Since no one answered my question, I did lab testing, wiresharek etc as well as some Google searches. I found a lot of others wondering about the same thing I am asking about, but no real answers. Here is what I believe is the answer. Understand that this may be a little bit incorrect as I do not have access to IOS internal code. When a packet comes into the router for delivery, and there is not existing ARP entry in cache, it sends out an ARP request, and immediately the router fills the ARP cache with an incomplete. the incomplete stays there for about 55 seconds unless an ARP reply is received. It an ARP reply is received the router fills the MAC address in the table. If 55 seconds pass without any more traffic, a ARP reply, etc, the incomplete entry ages out and the table is empty for that IP address.. So the situation I am seeing is that something is trying to communicate with the devices more often then once a minute. The router puts out an ARP request, does not get back a reply, and the device appears as always in the incomplete ARP status.
... View more
10-30-2012
11:20 AM
The zip file above is a sh arp, then clear arp, then sh arp, then tclsh ping, then sh arp. none of the mentioned devices reply to pings. they empty out of the arp cache (except 37 who I am guessing has user traffic to be delivered so the router arped it before the ping got a chance). The final sh arp for 37, 38, 136 are "incomplete" while 137-140 are not in the table at all.
... View more
10-29-2012
02:39 PM
Depending on OS and security setting B-cast pings are not replied to. Been there, got burned. Have a look at 37, 38, 136-140. Note that global edits done to replace IPs, to protect customer.
... View more
10-27-2012
10:52 AM
Didn't the router need to send an ARP request (or use ARP cache) to every device in order to complete the tclsh/tcl script? Clarification, the tcl script is tclsh scripting on the router.
... View more
10-27-2012
10:18 AM
Trying to discover IPs used on a subnet. The subnet does not have any firewalls, etc. Purely access layer switches attached to the router port and hosts attached to the switches (think remote office setup). What does the router use to determine putting incomplete vs "no entry" in the sh arp? BTW there is other live traffic through the router onto the segment, so the tcl ping script may not have been the packet to cause the original arp request to populate the arp cache. Thanks. Use tcl script similar to this to ping sweep segment: tclsh for { set i 1 } { $i <= 254 } { incr i } { ping 172.16.233.$i re 3 } Then do a sh arp and get response similar to this: show ip arp Protocol Address Age(min) Hardware Addr Type Interface Internet 172.16.233.22 9 0000.0c59.f892 ARPA FastEthernet0/0 Internet 172.16.233.21 8 0000.0c07.ac00 ARPA FastEthernet0/0 Internet 172.16.233.19 - 0000.0c63.1300 ARPA FastEthernet0/0 Internet 172.16.233.30 9 0000.0c36.6965 ARPA FastEthernet0/0 Internet 172.16.168.11 - 0000.0c63.1300 ARPA FastEthernet0/0 Internet 172.16.233.32 0 Incomplete ARPA Internet 172.16.168.254 9 0000.0c36.6965 ARPA FastEthernet0/0
... View more
Labels:
03-27-2012
04:01 PM
Well Nik, that was not this situation. In this case it looked more like this: printer 192.168.1.8 mask 255.255.255.248. They had run out of addresses and grabbed "address 0" for this printer, not a 0 digit address. I know the router was only running IP, but what I didn't get was the model or IOS version as it was not relevant to the task of documenting readdressing. I tried to recreate in a lab running IOS 12, and it just doesn't seem to work. Makes you wonder if you really saw what you know you did
... View more
03-27-2012
04:10 AM
Joseph, thanks for the RFC reference. I wished I had gotten more information about the PC and router configs. We were working on readdressing when we found it. We were confused as to why it worked at all. It was a printer with "address 0" being printed to by Win Vista and 7 machines. Also do not know specifics of the hosts configuration for printing other than the PC tech comment about "direct printing, not via MS domain print server". NB and other bridging protocols were disabled on the printer, so it was not bridging that we could tell.
... View more
03-25-2012
10:10 AM
Based on subnetting, the "all 1s" or last address in a subnet is the broadcast address. Why is the "all 0s" or first address reserved? About all I can find on the web is that "way back in time" it was also a broadcast address of some type. Is there current programmatic reasons, or just convention to reserve the first address of a subnet? Is there something I can see with a wireshark trace? I happen to run into a situation recently where a host was in fact using the resevered first address both on net and across the router, apparently without issues. Links to documentation appreciated. Thanks.
... View more
Labels:
08-09-2019
Thanks Reza Sharifi for the link. Sort of what I had found before
opening a TAC case. TAC keeps aski...
08-07-2019
I am in need of running debug for a long time (several days). I found
where the new Denali code uses...
12-22-2017
We use various tools and scripts to watch the network to make sure
things don't change "mysteriously...
07-05-2013
Thank you both for the information. Ivan, do you know if the message is
the same message as mentione...
07-04-2013
Cisco appears to use a lithium battery for holding NVRAM (as opposed to
some type of EEPROM or flash...
11-29-2012
Since no one answered my question, I did lab testing, wiresharek etc as
well as some Google searches...
10-30-2012
The zip file above is a sh arp, then clear arp, then sh arp, then tclsh
ping, then sh arp. none of t...
10-29-2012
Depending on OS and security setting B-cast pings are not replied to.
Been there, got burned. Have a...
10-27-2012
Didn't the router need to send an ARP request (or use ARP cache) to
every device in order to complet...
10-27-2012
Trying to discover IPs used on a subnet. The subnet does not have any
firewalls, etc. Purely access ...
03-27-2012
Well Nik, that was not this situation. In this case it looked more like
this: printer 192.168.1.8 ma...
03-27-2012
Joseph, thanks for the RFC reference. I wished I had gotten more
information about the PC and router...
Public Statistics
| Date Registered | 11-04-2004 03:02 PM |
| Date Last Visited | 08-15-2019 11:36 PM |
| Total Messages Posted | 14 |
.jpg "VIP Expert"){kind=icon}
