cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
667
Views
3
Helpful
2
Replies

I can't understand the logs

pgarron
Level 1
Level 1

I ran debug all and I can't understand the information:

Jan 30 10:14:06: IP: s=10.10.32.13 (Ethernet0/1), d=10.10.32.255 (Ethernet0/1), len 137, rcvd 3

Jan 30 10:14:06: UDP: rcvd src=10.10.32.13(631), dst=10.10.32.255(631), length=117

Jan 30 10:14:06: IP: s=10.10.32.13 (Ethernet0/1), d=10.10.32.255, len 137, dispose udp.noport

1. Addresses do broadcast, they send:

Jan 30 10:14:06: IP: s=10.10.32.13 (Ethernet0/1), d=10.10.32.255 (Ethernet0/1), len 137, rcvd 3

IP Protocol

2. Another packet, same address:

Jan 30 10:14:06: UDP: rcvd src=10.10.32.13(631), dst=10.10.32.255(631), length=117

UDP Protocol

I don't know what is port 631

3. The last, another packet IP

Jan 30 10:14:06: IP: s=10.10.32.13 (Ethernet0/1), d=10.10.32.255, len 137, dispose udp.noport

I don't know dispose udp.noport mean.

Why does every address send 3 packets.

2 Replies 2

raymong
Level 4
Level 4

In a broadcast environment, all machines on the wire will see every packet that goes by. All machines except the destination will ignore the packet because it is not for them.

In the case that the destination ip address is a broadcast address, all machines on the subnet are supposed to look at the packet.

In your scenario, 10.10.32.13 sends out a broadcast on udp port 631 (IPP - Internet Printing Protocol). Because the router does not have an application that uses this udp port, it will ignore the packet and generate the message "dispose udp.noport".

If you do not know what IPP is or believe that this host should not be generating traffic on this port, you should take a look at this particular host.

agugger
Level 1
Level 1

Hi

This are not 3 Packets, it is 1 Packet with different debug tasks.

It is because every task analyzes the same packet and produces his own messages. The First line is from Debug IP; the Second from debug udp etc. Debug all is good tool to find what happens by test but in living environment will a router short overloaded.

Regards

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: