Strange Message in syslog.log

[John Waller]

I don't know if anybody can help but here goes.

I have noticed on one of our sites the following message in the /var/adm/syslog/syslog.log file

Sep 17 08:45:03 xxxx syslog: received short packet from y.y.y.y
where xxxx is the hostname and y.y.y.y is the IP address of that host.

I am seeing about 5 of these messages a day. I am presuming that it is network related as I am also seeing " NFS getattr failed" messages at different times in the syslog.

This is occuring on a D Class running HP-UX 11.00. I don't believe that this is a serious error, but I am curious as to what is causing the problem and why it is receiving a short packet from itself??

[Rita C Workman]

Welllllllll.......this is kind of in the dark, but here goes.

I would check out those IP's being given indicating where these messages are generating from. BUT, it is very possible that the short-packet may be a CTS (Clear To Send) packet, which some apps send before the regular packet, especially since you mention those NFS messages. Some apps (often those doing API) utilize these behind the scenes 'hand-shaking' prior to actual transmission of data.

At least, that's what I thought it might be...others may have some better ideas....If it is nothing more than CTS, than your absolutely right to ignore them.

Regards,
Rita

[John Waller]

Incase I have not made it clear , the IP address given in all cases, is its own IP address and never that of a remote machine

[Scott Van Kalken · Accepted solution]

The NFS mega patch should fix this. I had a similar problem on a K class about 12 months ago - NFS mega patch - wham - gone.

[John Waller]

Many thanks for the information Scott, though I was hoping nobody would give that answer. Trying to find the down time to patch the system is like waiting for England to beat you at Cricket or Rugby (will never happen for many years)