Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

LMS 3.1 is Pinging huge number of weird IP addresses?!

Our security group is reporting Ping_sweep events from our LMS 3.1, (windows 2003) system to huge range of internal and public IP subnets, I am unable to locate this IP address range within the LMS application. I am wondering why  LMS is actuallying pinging this IP address range? and how can I stop it?

Thanks,

Muhannad

8 REPLIES

LMS 3.1 is Pinging huge number of weird IP addresses?!

It is the DFM part of LMS that tries to ping every IP address on every device.

This is the normal behaviour.

There is a file where you can exclude IP ranges from the DFM discovery. It wont try to ping thoose IP after a new discovery

file: /CSCOpx/objects/smarts/conf/discovery/discovery.conf

parameter is ipexclude=

It has a couple of examples. All excludes are on one line

Cheers,

Michel

Community Member

LMS 3.1 is Pinging huge number of weird IP addresses?!

Dear Michel.

I will test the workaround and get back to you.

Regards,

Muhannad

Community Member

LMS 3.1 is Pinging huge number of weird IP addresses?!

Dear Michel,

I tried to exclude the IP address using the parameter: ipExcludeList += 30.30.30.*  but this didn't stop the ping for this range.

During my test, i have disabled the DFM  process and this stopped the ICMP traffic for any IP address.

My question, can i make any changes in the GUI interface that will exclude these IP addresses and if the only workaround is using the parameter in the DFM conf file, kindly confirm that i am using the correct syntax:

#

ipExcludeList += 30.30.30.*

#

Thanks for your help,

Muhannad

Community Member

LMS 3.1 is Pinging huge number of weird IP addresses?!

Dears,

Please can you assist me about the way to filter traffic with the DFM.

Regards,

Muhannad

LMS 3.1 is Pinging huge number of weird IP addresses?!

The syntax is:

ipExcludeList += "30.30.30.*"

If you rediscover the device the IP range 30.30.30.1-255 will not be pinged.

Cheers,

Michel

Community Member

LMS 3.1 is Pinging huge number of weird IP addresses?!

Hi Michel,

This didn't work out, i have added this IP address and still the LMS sending the Ping sweep to this IP address.

I have turned off the DFMserver process and kept the  DFMserver1, this stopped the ping sweep to all the weird IP addresses but i am wondering if this will impact the DFM operations or i can use it as a workaround?

Also i read about a DFM patch that should stop the DFM ping sweep and make it work only with the SNMP polling: http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_device_fault_manager/faq/dfm_faq.html#wp1023696

Please can you confirm it and advise me about the proper patch to download, your help will be appreciated.

Regards,

Muhannad

Community Member

LMS 3.1 is Pinging huge number of weird IP addresses?!

Dears,

Any update regarding the above post?

Thanks,

Muhannad

LMS 3.1 is Pinging huge number of weird IP addresses?!

Unless you have a very large number of devices, all devices will be managed by DFMServer.

You may wish to look in the help how to get to the DFM detailed device view.

In there you can per device disable the managemend of IP addresses.

Cheers,

Michel

716
Views
0
Helpful
8
Replies
CreatePlease to create content