4250 appliance not processing packets correctly

[vianet0]

Following are symptoms:

Starts with

errorMessage: name=errWarning ARP: bad operation from packet ###

Shortly after this we see events such Frag Too Small (1206)

And following this the following message appears repeatedly

errorMessage: name=errWarning Producer appears to be out of superblocks..consider configuring TCPReassemblyMode to loose FreeBlocks: 7

Following this there are missed packet count events (no other events) until the appliance is rebooted.

Any ideas on what could be causing this??

[mchin345]

I guess this could be related to bad memory on the sensor or traffic too heavy on the lan segment where the sensor's sensing interface is connected.

[npham]

We see similiar problems with multiple 4250 appliances. Our TAC case has been open over a month now with no resolution yet.

[rhermes]

The sensor is working too hard, if you check your CPU util, I'd bet its through the roof. Look for a signature that requires the sensor to examine every packet. To prove this you could reset your signatures to factory defaults and see if the condition persists.

[Jeffrey Bollinger]

What's the exact version of software are you running?

[npham]

Version is 4.1(5) S201

CPU utilization is not through the roof. The sensors operate for some time, and then all start to experience the error roughly about the same time (within a few days of each other). All monitoring different networks with different load levels.

For more details, my TAC service request # is 602767977.