cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1340
Views
3
Helpful
4
Replies

How to deal with :%MLS_STAT-SP-4-IP_LEN_ERR: MAC/IP length inconsistencies

behigh
Level 1
Level 1

Hi, dear there:

Here I got some info from cisco web, at the last, it recommand using sniffer, but in the message,it also said the switch drop these kind of packets, so how can I capture it.

If there is any other way to deal with this problem?

Thanks in advance!

======================================

Problem

The switch reports this error message:

%MLS_STAT-SP-4-IP_LEN_ERR: MAC/IP length inconsistencies

This example shows the console output that is displayed when this problem occurs:

May 29 21:54:14 JST: %MLS_STAT-SP-4-IP_LEN_ERR: MAC/IP length inconsistencies

May 29 23:10:44 JST: %MLS_STAT-SP-4-IP_LEN_ERR: MAC/IP length inconsistenciesDescription

These messages indicate that packets were received in which the IP length does not match the MAC length of the packet. The Supervisor Engine dropped these packets. There are no negative effects on the switch because it drops the packets. The switch reports the message for informational purposes. The cause of the issue is a device on the network that sends out bad packets. These issues, among others, can cause the bad packets:

Bad NICs

Bad NIC drivers

Bad applications

Use a network sniffer in order to find the source that sends out the erroneous packets. Then, resolve the issue with the source device or application.

============================================

4 Replies 4

pradeepde
Level 5
Level 5

The IP length errors indicate that you have a source sending in traffic with incorrect length in the headers. Narrow it down to what externally connected device can be sending in these bad packets. You can do this by shutting interfaces until you can narrow it down.

You can also get an idea of how many of such packets are being received by doing 'show mls stat ' multiple times and seeing how much the counts for "Errors" are incrementing.

But you need to try and narrow this down to the external source that's generating the frames which the earl detects as having bad lengths. IF you find it's coming from a specific traffic generator, then try a different traffic generator.

behigh
Level 1
Level 1

After Opened a Case, the problem has been resolve.

because the SP drop such bad packets, so you can't caputer them by normal way.

The TAC give out some internal commands, make the SP to transfer the BAD Packet to a dedicate port, the the sniffer works.

And by compare the log timestamp with the sniffer, you can know which IP or MAC sent this packet.

Tips: In this case, you can see in the sniffer, that the DLC Frame length is smaller than the IP segment length. That's why the 6509 triger the error message!

I am suffering the same problem with you . Would you advise the internal command provided by TAC ? Thks !!

Hi, could you give me the commands as well please, I have the same problem for a while now, happening maybe once every couple of days. I wish to isolate the source using the same methods.

Thanks

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco