What causes input packets on Null0?

Unanswered Question
Sep 24th, 2010

Hello, I wonder if anyone can tell me what are the possible causes for input packet hits on interface Null0? (I'm not talking about output packet hits caused by blackhole routing). I first noticed this on a 3800 VPN router, but I've now noticed it on a 6500.

Any ideas?

Thanks, Andy.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
sumitava123 Fri, 09/24/2010 - 01:16

HI Andre ,

I am not able to understand your questions properly.The Null interface is typically used for preventing routing loops.

Can you please elaborate your question.

Sumit

Andrew Ward Fri, 09/24/2010 - 01:32

Sumit,

see the output below:

6500-1#sho int null0
Null0 is up, line protocol is up
  Hardware is Unknown
  MTU 1500 bytes, BW 10000000 Kbit, DLY 0 usec,
     reliability 0/255, txload 0/255, rxload 0/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Last input never, output never, output hang never
  Last clearing of "show interface" counters 00:33:38
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     51827 packets input, 47751783 bytes, 0 no buffer
     Received 0 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 output buffer failures, 0 output buffers swapped out

I want to understand what the input packets are.

Thanks, Andy.

sumitava123 Fri, 09/24/2010 - 02:07

Hi ,

Can you please share the following command output.

sh ip route | i null

Regards

Sumit

Andrew Ward Fri, 09/24/2010 - 02:20

Sumit,

on my 6500 I have 5 routing entries via Null0. These are 32 bit entries generated as a result of config which is on a CSM in the 6500.

But on my 3800 VPN router, there are not routing entries via Null0. So these input packet stats don't seem to be connected to the routing table entries.

I'm trying to get my head around the concept of a packet coming out of a Null0 interface. It seems a bit like light coming out of a black hole!

Thanks, Andy.

Andrew Ward Mon, 09/27/2010 - 06:12

Does anyone else have any ideas on this? Or do you see similar stats when doing a 'show int null0' on your kit?

Thanks, Andy.

shijomon scaria Mon, 09/27/2010 - 07:36

Hello Andrew,

Read the below passage by 'Scott Morris'

"The Null0 "interface" is a virtual bit-bucket. Meaning it's a trash can to route things to. There's automatically a Null0 route (called a Discard Route) created when you do a summary-address or area-range or things like that with routing protocols.

The idea behind this is that you are creating a summary address manually to tell other routers about. If you are therefore expecting to receive packets for anything within that summary range, what will your router do about it? if it has more specific routes, packets will get routed perfectly fine.

Anything not matching more specific routes would get sent to the discard route and therefore destroyed in a flash of Null0 mayhem. Without the discard route, your router would be either trying to look things up or possibly sending to a default route (0.0.0.0/0) it has in its table. This in turn, may cause a routing loop where the router with the 0/0 route contains the summary you manually advertised and so packets bounce needlessly until the TTL expires!

It's a protection mechanism.

You may also use Null0 as a destination in static routes if you would like particular packets to die a horrible death as well! "

I hope  this will give ur answer.

Regards,

Shijo.

shijomon scaria Wed, 09/29/2010 - 02:44

Hello Andrew,

Read the below passage by 'Scott Morris'

"The Null0 "interface" is a virtual bit-bucket. Meaning it's a trash can to route things to. There's automatically a Null0 route (called a Discard Route) created when you do a summary-address or area-range or things like that with routing protocols.

The idea behind this is that you are creating a summary address manually to tell other routers about. If you are therefore expecting to receive packets for anything within that summary range, what will your router do about it? if it has more specific routes, packets will get routed perfectly fine.

Anything not matching more specific routes would get sent to the discard route and therefore destroyed in a flash of Null0 mayhem. Without the discard route, your router would be either trying to look things up or possibly sending to a default route (0.0.0.0/0) it has in its table. This in turn, may cause a routing loop where the router with the 0/0 route contains the summary you manually advertised and so packets bounce needlessly until the TTL expires!

It's a protection mechanism.

You may also use Null0 as a destination in static routes if you would like particular packets to die a horrible death as well! "

I hope  this will give ur answer.

Regards,

Shijo.

Andrew Ward Sun, 10/10/2010 - 01:22

Shijo,

if my understanding is correct, that would cause output packets hits on Null0. I understand Null0's role in routing protocol loop prevention.

Does anyone else see input packet hits on Null0?  - I'm sure there is nothing very special about my setup.

Thanks.

Actions

This Discussion