02-12-2006 08:05 PM
Hi, dear there:
Here I got some info from cisco web, at the last, it recommand using sniffer, but in the message,it also said the switch drop these kind of packets, so how can I capture it.
If there is any other way to deal with this problem?
Thanks in advance!
======================================
Problem
The switch reports this error message:
%MLS_STAT-SP-4-IP_LEN_ERR: MAC/IP length inconsistencies
This example shows the console output that is displayed when this problem occurs:
May 29 21:54:14 JST: %MLS_STAT-SP-4-IP_LEN_ERR: MAC/IP length inconsistencies
May 29 23:10:44 JST: %MLS_STAT-SP-4-IP_LEN_ERR: MAC/IP length inconsistenciesDescription
These messages indicate that packets were received in which the IP length does not match the MAC length of the packet. The Supervisor Engine dropped these packets. There are no negative effects on the switch because it drops the packets. The switch reports the message for informational purposes. The cause of the issue is a device on the network that sends out bad packets. These issues, among others, can cause the bad packets:
Bad NICs
Bad NIC drivers
Bad applications
Use a network sniffer in order to find the source that sends out the erroneous packets. Then, resolve the issue with the source device or application.
============================================
02-16-2006 07:06 AM
The IP length errors indicate that you have a source sending in traffic with incorrect length in the headers. Narrow it down to what externally connected device can be sending in these bad packets. You can do this by shutting interfaces until you can narrow it down.
You can also get an idea of how many of such packets are being received by doing 'show mls stat ' multiple times and seeing how much the counts for "Errors" are incrementing.
But you need to try and narrow this down to the external source that's generating the frames which the earl detects as having bad lengths. IF you find it's coming from a specific traffic generator, then try a different traffic generator.
02-19-2006 04:11 AM
After Opened a Case, the problem has been resolve.
because the SP drop such bad packets, so you can't caputer them by normal way.
The TAC give out some internal commands, make the SP to transfer the BAD Packet to a dedicate port, the the sniffer works.
And by compare the log timestamp with the sniffer, you can know which IP or MAC sent this packet.
Tips: In this case, you can see in the sniffer, that the DLC Frame length is smaller than the IP segment length. That's why the 6509 triger the error message!
02-21-2006 05:40 PM
I am suffering the same problem with you . Would you advise the internal command provided by TAC ? Thks !!
02-22-2006 05:54 AM
Hi, could you give me the commands as well please, I have the same problem for a while now, happening maybe once every couple of days. I wish to isolate the source using the same methods.
Thanks
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: