2524 - tftp: SENT error:1, msg:

[swaize]

It seems all of a sudden a number of our 2524's have started spamming our trap receiver with following error. (I am running F.05.72)

W 08/24/10 09:45:45 tftp: SENT error:1, msg: File not found
W 08/24/10 09:45:48 tftp: SENT error:1, msg: File not found
W 08/24/10 09:45:51 tftp: SENT error:1, msg: File not found
W 08/24/10 09:45:54 tftp: SENT error:1, msg: File not found
W 08/24/10 09:45:57 tftp: SENT error:1, msg: File not found
W 08/24/10 09:46:00 tftp: SENT error:1, msg: File not found
W 08/24/10 09:46:03 tftp: SENT error:1, msg: File not found
W 08/24/10 09:46:06 tftp: SENT error:1, msg: File not found
W 08/24/10 09:46:09 tftp: SENT error:1, msg: File not found
W 08/24/10 09:46:12 tftp: SENT error:1, msg: File not found
W 08/24/10 09:46:15 tftp: SENT error:1, msg: File not found
W 08/24/10 09:46:18 tftp: SENT error:1, msg: File not found

Another post in this forum seemed to suggest this was caused by a tftp server requesting a non-existent file. I set up a monitoring port and captured packets in wireshark to try and find the offending server. Seems in this case, it is not a tftp server causing the issue. In fact I can't explain what it happening!!

If you check the attached capture file, you can see the error occur from packet 304. You will see that the switch (10.10.1.10) sends a udp packet to the router on it's lan (10.10.1.1), then immediately after this, the switch sends error traps to our two trap receivers (10.1.11.144 & 192.168.255.200).

It's seems these udp packets originate from the 2524 itself, and are also triggering the error some how. Also notice that each UDP packet has strange title after source port in the info column: propel-msgsys, watuilapp, ivcollector, dellwebadmin-1. Where is it getting his from? Looks like it is going through a list?

Any thoughts on this much appreciated.

[swaize]

Think I have found answer to this.

Looks like our site routers have been broadcasting tftp request asking for a config file. Our 2524's do not seem to like this!

Found it by doing another unfiltered capture and saw the broadcast this time.

We have had recent config changes made to these routers, by our provider, so sure this is it.

[swaize]

See last post