UDP Socket Overflows on 6005 Switches

[FreshKing]

Hi

In my firm we have 4 6005 switches, 2 are our core, on the core switches we are getting continues udp socket over flows, the ports can be anything like 1358, 1166 and 1257.

I have tried to monitor using sniffer basic, Eye of The Storm, ciscoworks all report back with nothing

is there any thing i could do to stop these overflows?

I have spoken to our so called external support, but they have no clue either

can anyone help

 

[jgercken]

What SNMP managers are you using? If one is set to pole a large number of MIBs at a fast rate you can overload the switch w/ UDP. They should be port 161 though. Are you using an MSFC? Do you have ip permit enabled? I'm assuming that the switch is the destination of the packets (since socket & not buffer overflow), right? Check out your process utilization with the ps command (undocumented)
ps returns process status & invocations
ps -i returns process interrupt info
ps -c returns process cpu utilization
ps -s returns process stack utilization
and I have no idea what ps -p does.

Sniffer reports nothing? What do the packets look like? Capture them using a security acl w/ the capture option.


----------------------------------------
Wassabi Pop Tarts! Write Kellogs today!

 

[FreshKing]

hi

ok i have tried your ps commands but and idle time is great it is at ranging from 94-96% which means hardly anything is being used.

I looked on the internet and port 1366 is novell netware??? can anyone confirm this?

Yes it is the destination our core, then it again passes data on again.

we have HP Webjet admin that is the largest thing that i know to pole any devices.

Any other ideas?

 

[FreshKing]

no worries all fixed, it was solar winds causing the udp errors