topic Re: strange message in PCM in Switches, Hubs, and Modems

strange message in PCM

stieven struyf — Fri, 20 Apr 2007 02:22:43 GMT

Every 10 seconds i see these messages coming from one switch in the network. In the eventlog on the switch itself i don't find anything strange.there are no noticeable problems on the network either.
Anyone knows what this message means(didn't find any part of the message on google either)?

Event type:
Trap
Trap type:
Enterprise Specific
Received from:
X.X.X.X(X.X.X.X)
Date received:
Fri Apr 20 09:15:27 CEST 2007
Date acknowledged:
Event has not been acknowledged.
Severity:
Minor
Event Description
36 284692 256 0x00:15:60:00:26:80 0x80:24

Re: strange message in PCM

Matt Hobbs — Fri, 20 Apr 2007 04:01:28 GMT

There is an option in Preferences to ignore unknown traps which you may want to try.

If you are interested in the trap itself, maybe connect a sniffer to see if it's any more readable that way.

Re: strange message in PCM

stieven struyf — Fri, 20 Apr 2007 04:17:02 GMT

Is there no list of known events the switch sends?
btw. it's an 2848, the messages only come from one switch.
might it be an hardware issue on the switch?

so i see more with a packet sniffer(like ethereal).

Before i ignore the event i want to now what it means.

Re: strange message in PCM

Matt Hobbs — Fri, 20 Apr 2007 08:06:04 GMT

I'd want to know too before ignoring it. I always install ethereal/wireshark on my PCM server for these types of issues. Also helps a lot when troubleshooting any PCM connectivity issues.

PCM is supposed to be pre-configured to interpret all the known traps, unless this is a trap that maybe occurs on newer firmware only?

Re: strange message in PCM

stieven struyf — Fri, 20 Apr 2007 08:42:00 GMT

i attached the ethereal output. how do i interprete this?

Re: strange message in PCM

Richard Brodie_1 — Fri, 20 Apr 2007 10:51:53 GMT

Run the OIDs past something that can parse the MIBs (e.g. snmpget) and give you the text representation.

Roughly:

HP private - Stp port: 36
HP private - counter (undocumented)
RFC1493 - state: 256?
RFC1493 - Designated bridge (me)
RFC1493 - Designated port: 24.

Clear as mud: anyway something relating to the spanning tree configuration on port 36.

Re: strange message in PCM

Matt Hobbs — Fri, 20 Apr 2007 11:44:38 GMT

That sounds very likely - there are new traps to indicate if the root bridge has changed and I think a few other spanning-tree related warnings. Thanks for reminding me.

I have feeling that even Update 9 does not interpret these traps.

PCM 2.2 is out June 1 - maybe this will add support for these traps?

http://www.hp.com/rnd/news/hp_fortifies_security.htm