Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

NAM-1 capture filters - less than 64byte packet ?

Hi, I'm getting the following error on one of my 6509's.

%SYS-4-SUPERVISOR_ERR:Forwarding engine IP length error counter = 126.

I opened a ticket with Cisco and they say it's when a packet of less that 64 bytes is received my the 6509. I need to narrow this down to a slot/port.

I have a NAM-1 installed in the 6509 and I can span each VLAN back to it and perform a capture with a filter of frames less than 64 bytes.

Does anyone know how I can define this on the NAM-1. I cannot see an option in the custom filters menu.

NAM-1 is version 3.4 (1.a patch 2)



Re: NAM-1 capture filters - less than 64byte packet ?


Problem: The following error messages are recorded in the syslog:

%SYS-4-SUPERVISOR_ERR:Forwarding engine IP length error counter =4

%SYS-4-SUPERVISOR_ERR:Forwarding engine IP too short error counter =1

%SYS-4-SUPERVISOR_ERR:Forwarding engine IP check sum error counter = 38

Description: These messages indicate that the switch forwarding engine is getting an IP packet that is less than the minimum length of the allowed IP-packet, and dropping it. In older code (pre-7.x), the packet was silently dropped and counted in the forwarding engine stats. In newer code (7.x and above), this message is recorded in the syslog once every 30 minutes.

There is no effect on the switch side. The switch side is dropping the bad packet, which would have been dropped by the receiving device consequently. The only concern is that there is a device sending bad packets (possibly due to a bad NIC driver, NIC driver bug or bad application, and so on). The Supervisor Engine does not keep track of the source-ip of the device that is sending the bad packets. The only way to detect these devices is to use a sniffer to track down the source address.

This message is just a warning/informational message from the switch. To disable these error messages, issue the set errordetection portcounters disable command on the switch.

CreatePlease login to create content