Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

%IP-3-UDP_SOCKOVFL: UDP socket 161 overflow messages


Currently getting %IP-3-UDP_SOCKOVFL: UDP socket 161 overflow messages from 4000 and 6509 switches.

4000 =version 6.2(2)

6509= version 6.2(3)

Anyway of stopping these ?

  • Other Network Infrastructure Subjects
New Member

Re: %IP-3-UDP_SOCKOVFL: UDP socket 161 overflow messages

I have the same problem with 5000 series switches. I think Bug ID

CSCdz55568 may be related to your issue


Re: %IP-3-UDP_SOCKOVFL: UDP socket 161 overflow messages

Using the IOS Error Message Decoder Tool on CCO:

The above message has the following details:

'1. %IP-3-UDP_SOCKOVFL: UDP socket [dec] overflow

This message indicates that all buffers for a UDP socket on the NMP have filled up due to excessive UDP traffic on the administrative VLAN. The system may be under attack or an network management application might be out of control. [dec] is the UDP socket number.

Recommended Action: You could remove or block the source of the UDP packets to prevent further UDP packet loss, or use a network analyzer to identify the source of the traffic. '

New Member

Re: %IP-3-UDP_SOCKOVFL: UDP socket 161 overflow messages

Dont think system is under attack, problem seems to be with different polling intervals set with RME, DFM , Campus Mgr components, currently the setting are as below monitoring situation to see if problem regenerates.

RME->Administration->Availability-Change Polling Options

Poll Reload & Protocol Distribution Every 2 Hours

Verify Status Interface Every 60 Minutes

Verify Device Reachability Every 15 Minutes

Campus Manager->Topology Map Discovery

SNMP Polling Frequency Every 300 Seconds

(used to be 60 seconds)

Device Fault Manager Rediscovery schedule Every Friday 12:00pm

Server Configuration->Setup->Discover Schedule

Hours Minutes

Discovery Mon-Sun 5 00

Polling Every 0 10

Settings Before :-

Discover Schedule

Mon-Sun Hours Minutes

0 00

4 00

8 00

12 00

16 00

20 00

Polling Every 0 5

Re: %IP-3-UDP_SOCKOVFL: UDP socket 161 overflow messages


I've got the same problem with 6509 switches. But error messages varies between devices, onsome of them:

%IP-3-UDP_SOCKOVFL: UDP socket 1139 overflow-------???

On the others:

%IP-3-UDP_SOCKOVFL: UDP socket 161 overflow--------OK SNMP

THese errors appears almost the same time evry night.


Re: %IP-3-UDP_SOCKOVFL: UDP socket 161 overflow messages

It's probably some "crazy" machine doing network scanning.

I've noticed several times some UNIX and NT servers trying to SNMP scan my network, always around 1:00 a.m.

Have you tried to capture IP packets to see what's happening during that time?