Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

I can't understand the logs

I ran debug all and I can't understand the information:

Jan 30 10:14:06: IP: s=10.10.32.13 (Ethernet0/1), d=10.10.32.255 (Ethernet0/1), len 137, rcvd 3

Jan 30 10:14:06: UDP: rcvd src=10.10.32.13(631), dst=10.10.32.255(631), length=117

Jan 30 10:14:06: IP: s=10.10.32.13 (Ethernet0/1), d=10.10.32.255, len 137, dispose udp.noport

1. Addresses do broadcast, they send:

Jan 30 10:14:06: IP: s=10.10.32.13 (Ethernet0/1), d=10.10.32.255 (Ethernet0/1), len 137, rcvd 3

IP Protocol

2. Another packet, same address:

Jan 30 10:14:06: UDP: rcvd src=10.10.32.13(631), dst=10.10.32.255(631), length=117

UDP Protocol

I don't know what is port 631

3. The last, another packet IP

Jan 30 10:14:06: IP: s=10.10.32.13 (Ethernet0/1), d=10.10.32.255, len 137, dispose udp.noport

I don't know dispose udp.noport mean.

Why does every address send 3 packets.

2 REPLIES
Bronze

Re: I can't understand the logs

In a broadcast environment, all machines on the wire will see every packet that goes by. All machines except the destination will ignore the packet because it is not for them.

In the case that the destination ip address is a broadcast address, all machines on the subnet are supposed to look at the packet.

In your scenario, 10.10.32.13 sends out a broadcast on udp port 631 (IPP - Internet Printing Protocol). Because the router does not have an application that uses this udp port, it will ignore the packet and generate the message "dispose udp.noport".

If you do not know what IPP is or believe that this host should not be generating traffic on this port, you should take a look at this particular host.

New Member

Re: I can't understand the logs

Hi

This are not 3 Packets, it is 1 Packet with different debug tasks.

It is because every task analyzes the same packet and produces his own messages. The First line is from Debug IP; the Second from debug udp etc. Debug all is good tool to find what happens by test but in living environment will a router short overloaded.

Regards

125
Views
3
Helpful
2
Replies
CreatePlease to create content