6509 SYS-4-SUPERVISOR_ERR: How can I trace to a port ?

[dtushing123]

Hi, I seeing these errors daily on one of my 6509's

SYS-4-SUPERVISOR_ERR:

Forwarding engine IP length error counter = 93

This is caused by a malformed packet from a bad nic or app etc being dropped by the supervisor.

My question is how can I troubleshoot this, I mean how can I catch it with a sniffer. I have alot of ports on the 6509.

I do have a Cisco Nam-1 in the 6509, if there's something I could do with that then any pointers would help.

I just can't think how I can isolate this to the port / nic that's causing the problem.

Thanks for any ideas

[dtushing123]

I think I'm going to clear all the counters and monitor increments in any of the align, runts, giants etc etc on each port on each blade until I find it.

[spremkumar]

hi

Do check this note taken from CCO..

%SYS-4-SUPERVISOR_ERR:

Problem

These error messages appear in the syslog:

%SYS-4-SUPERVISOR_ERR:Forwarding engine IP length error counter =4

%SYS-4-SUPERVISOR_ERR:Forwarding engine IP too short error counter =1

%SYS-4-SUPERVISOR_ERR:Forwarding engine IP check sum error counter = 38 Description

These messages indicate that the switch forwarding engine receives an IP packet of a length that is less than the minimum allowed length and then drops the packet. In code versions that are earlier than 7.x, the forwarding engine silently drops the packet and counts the packet in the forwarding engine statistics. In code versions that are 7.x or later, this message is recorded in the syslog once every 30 minutes.

There is no effect on the switch side. The switch side drops the bad packet, which the receiving device would have dropped consequently. The only concern is that there is a device that sends bad packets. The possible causes include a bad NIC driver, a NIC driver bug, or a bad application. The Supervisor Engine does not keep track of the source IP address of the device that sends the bad packets. The only way to detect these devices is to use a sniffer in order to track down the source address.

This message is only an informational message and warning from the switch. Issue the set errordetection portcounters disable command on the switch in order to disable these error messages.

regds