HPUX and routing

[itsd2001]

Hi,

We have a Server running HPUX 11.x and

1)when using Mib browser to see the routing table we are seeing big routing table. Also the default gateway is not there

2)When using netstat -rn we don't see this big routing table and the default gateway is there.

The sys admin for this box is telling us that the routing protocol is disabled "this server has two NIC".

Why we have two different output?

Thanks

[Michael Tully]

It would appear that you could be utilising gated or routed. Perhaps you you posted the output of /etc/rc.config.d/netconf we could assist further.

[itsd2001]

Because the box is not mine "very difficult to get any info with the sys admin of this box", is there any utility that use snmp that I can use to check if gated or routed is running on this box.

Thanks

[Dave Olker]

Just curious - if you have no control of the system or access to the system, what good will knowing whether gated or routed do you?

Michael is very likely correct in his statement about routed/gated running. It is typical of those protocols to remove the default route and to have huge routing tables. However, without access to the system, and root access at that, there isn't much you can do about the routing tables or the routing protocols that are managing those tables.

Regards,

Dave

[Michael Tully]

Sorry, I don't believe there are any backdoor methods. Unless you have local shell/rexec access to the system, suggest you make the sys admin your best friend and ask him/her for the information.

[Muthukumar_5]

We can get all informations about routing (including dead gateways) then go for ndd command for /dev/ip parameters as,

# ndd -get /dev/ip ip_ire_hash

It will give all informations about your routing. ( root permission needed to do)

you can no more informations on /etc/rc.config.d/netconf . Any user can view the settings

Can you give the examples of differences which u find over in mib and in netstat -rn

or ndd (if you have root permission)

[itsd2001]

I attached the output for netconf, ip_ire_hash and netstat -rn.

I am network Analyst and sys Admin is pointing this to be network problem and we want fix this routing problem with this server.

Only this server is doing this.

Thanks

[Sundar_7]

Hi,

You can use snmpwalk from the remote system to find out the processes running in the HP-UX system.

# snmpwalk hp.nm.system.general.processes.processTable.processEntry.processCmd

The above command will list all the processes runnign in the remote node.

If the get community name is set to somethign other than the default, you might need to mention it with the snmpwalk command

Sundar

[itsd2001]

DID snmpwalk and did not see any gated or routed process.

[Dave Olker]

Did the routing table returned by the MIB browser match the routing table returned by the "ndd -get /dev/ip ip_ire_hash" command?

I realize that the ip_ire_hash list is different than the routing table returned by the "netstat -rn" command, but I'm trying to understand your question specific to the MIB browser. If the MIB browser is returning the same routing list as the ip_ire_hash list then I guess your question becomes: "Why are the routing lists returned by ndd and netstat different?"

Let me know if the ip_ire_hash list and the list from the MIB browser are the same and we can proceed from there.

Thanks,

Dave

[itsd2001]

I am getting the same result from:

1)"ndd -get /dev/ip ip_ire_hash", SMPWALK, OPENVIEW MIB Browser, SolarWinds, Getif utility that I download from the net.

2) The result is completely different from "netstat -rn".

The tools listed in 1) show as default Gateway the same IP as the box "142.205.151.245"

But "netstat -rn" and netconf show the default Gateway "142.205.148.1"

See attached file

Thanks,

[itsd2001]

Attached the output of

1)OpenView Mib browser
2) GEIF
3)SOlarWinds

See attached file

Thanks

[Patrick Wallek]

I think what you are seeing is normal. I checked a couple of my machines and I see big differences in the output of 'netstat -rn' and 'ndd -get /dev/ip ip_ire_hash' as well. I *THINK* what happens is each "remote" machine that this machine communicates with gets an entry in the table that you are looking at with ndd, snmp, etc., but only the base route is listed with netstat.

Honestly, I wouldn't worry about the difference very much at all. I really don't think there is a problem.

My question now is -- What led your unix administrator(s) to question this? What do they perceive the problem to be? Are they seeing network performance issues?

[itsd2001]

On local subnet every things works fine "users are using SAS" but for other user that are not in the same subnet their were having lot of problem "machine completely hangs, windows freeze, slow,...".

The problem is with only this machine. We have 4 other HPUX working fine in local and remote subnet.

The result of "netstat -rn", "OpenView Mib browser", Getif, ... are the same on the 4 HPUX machine that user have no problem.

[Dave Olker]

Hi all,

Just to close the loop on why the output from "netstat -rn" and "ndd -get /dev/ip ip_ire_hash" return different values - the ndd command returns the full ire hash contents while the netstat command filters out specific entries.

Looking at the code, one of the first things netstat does is eliminate any of the entries whose route type is MIB2_ROUTE_other. These entries show up in Solarwinds and GetIF as type "other". If you look at the "type" column in GetIF or the ipRouteType column in Solarwinds and eliminate any entries of type "other" you will end up with a list very similar to the netstat -rn output. The remaining entries are organized according to whether they are host route entries, gateway entries, etc.

So, the ndd command does return the full route table and netstat returns a filtered version of the route table.

As for having systems where the netstat and ndd output return exactly the same entries? I haven't seen a system where that is the case in my network. Every system I've tried this on has many ndd entries that don't show up in the netstat output.

Bottom line, I don't consider having extra entries in your ndd ip_ire_hash list compared to the "netstat -rn" output to be a problem or a source of concern.

As for why things work fine on one subnet and not on another, I'd start looking at things like network traces of a working system and compare them to a failing system and look for differences. Is the failing trace showing packets not making it from client to server or vice versa? While this could indicate a routing problem, it is not necessarily a routing problem.

Regards,

Dave

[itsd2001]

Thanks Dave for the clarification. I am going to put sniffer and see what I can find. Thanks again

[itsd2001]

Dave,

Can you provide with netstat code and highlight where netstat code eliminate any of the entries whose route type is MIB2_ROUTE_other.

Thanks

[Dave Olker]

No, I cannot provide the netstat code. I have access to the code because I work in the HP-UX Networking lab, but I have no right to distribute the code.

The code function I was referring to is called route_report_ipv4, and it get called from a while() loop in the main code path as netstat processes the route MIBs it retrieved from its SNMP call. There are a number of condition checks inside a for() loop within route_report_ipv4, one of which is:

if (re->ipRouteType == MIB2_ROUTE_other)
continue;

If it encounters an ipRouteType of MIB2_ROUTE_other it skips it and the for() loop goes to the next entry.

Regards,

Dave

[itsd2001]

Thanks Dave. I tough that the code is available for every one.

THanks

[Patrick Wallek]

This is HP-UX, not LINUX. There is no way HP is going to make the HP-UX code available outside of the HP-UX labs.