9300 Gig interface errors

[Mohieddin Kharnoub]

Apprently, you have been Flooded with Microsoft-DS , its like a broadcast reported by PCM+.

This sometimes happens by some kind of Worm Virus associated with AOL IM and IRC, or Malware software.

You can see the sources and destinations fro mthe last picture you attached, check it out and try to isloate this flood from the network then watch the PCM output.

Don;t forget to assign points to any post you got.

Good Luck !!!

[Jonathan Axford]

Good morning everyone!

I have been monitoring this for about 2 1/2 hours today, and so far, it hasn;t happened again.

The main destinations shown in the graphs are my SAN where the students and staff profiles and documents are stored. This is often very busy as at certain points in the day there can be 300 + people logging on at once.

I have checked our anti virus server, which hasn't detetced any unusual AV activity.

I will keep an eye on it a bit longer to see if it crops up again,

Thanks for all your help so far...!!!

[Matt Hobbs]

I've been thinking a bit more about this as well...

What I would do is use a MIB browser and walk those switches.

I like iReasoning's MIB browser:
http://www.ireasoning.com/

Download the ProCurve MIBs:

http://www.hp.com/rnd/software/MIBs.htm

Load the 9300 MIBs into the browser and then walk the switch. You might see some interesting counters there that will hopefully explain exactly what caused those errors to be reported in PCM+.

[Jonathan Axford]

Hello again,

Thanks for the help, I am not entirely sure how to go about that having never done it before. I have downloaded the free version of Ireasoning and the HP MIBS but it all looks a bit confusing!

I am not sure which ones to load into the application as there are hundreds in the .ZIP file from HP. Anyway, i will give it a go...

[Jonathan Axford]

Is all a bit confusing. Any links or pointers on how to do this would be much apprecited!

[Matt Hobbs]

Load as many of these MIBs as you can (max is 5 with the free version).

rfc1212.mib*
rfc1213.mib
rfc1215.mib*
rfc1742.mib
rfc2578.mib
rfc2579.mib
h2r07601a.mib

Definitely include the last one.

It is a bit advanced, I can't really give much other guidance except to just play around with it.

[Jonathan Axford]

Hi again all,

Seems to have dissappeared now... Have had no errors or large amounts of traffic registered on any of the devices today....

Nothing has changed config wise so not sure what happened! Will keep an eye on it though....