cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
420
Views
0
Helpful
5
Replies

%IP-3-UDP_SOCKOVFL: UDP socket 161 overflow messages

mistryj
Level 1
Level 1

Hello,

Currently getting %IP-3-UDP_SOCKOVFL: UDP socket 161 overflow messages from 4000 and 6509 switches.

4000 =version 6.2(2)

6509= version 6.2(3)

Anyway of stopping these ?

5 Replies 5

nci_netops
Level 1
Level 1

I have the same problem with 5000 series switches. I think Bug ID

CSCdz55568 may be related to your issue

rmushtaq
Level 8
Level 8

Using the IOS Error Message Decoder Tool on CCO:

http://www.cisco.com/cgi-bin/Support/Errordecoder/home.pl

The above message has the following details:

'1. %IP-3-UDP_SOCKOVFL: UDP socket [dec] overflow

This message indicates that all buffers for a UDP socket on the NMP have filled up due to excessive UDP traffic on the administrative VLAN. The system may be under attack or an network management application might be out of control. [dec] is the UDP socket number.

Recommended Action: You could remove or block the source of the UDP packets to prevent further UDP packet loss, or use a network analyzer to identify the source of the traffic. '

Dont think system is under attack, problem seems to be with different polling intervals set with RME, DFM , Campus Mgr components, currently the setting are as below monitoring situation to see if problem regenerates.

RME->Administration->Availability-Change Polling Options

Poll Reload & Protocol Distribution Every 2 Hours

Verify Status Interface Every 60 Minutes

Verify Device Reachability Every 15 Minutes

Campus Manager->Topology Map Discovery

SNMP Polling Frequency Every 300 Seconds

(used to be 60 seconds)

Device Fault Manager Rediscovery schedule Every Friday 12:00pm

Server Configuration->Setup->Discover Schedule

Hours Minutes

Discovery Mon-Sun 5 00

Polling Every 0 10

Settings Before :-

Discover Schedule

Mon-Sun Hours Minutes

0 00

4 00

8 00

12 00

16 00

20 00

Polling Every 0 5

Hi,

I've got the same problem with 6509 switches. But error messages varies between devices, onsome of them:

%IP-3-UDP_SOCKOVFL: UDP socket 1139 overflow-------???

On the others:

%IP-3-UDP_SOCKOVFL: UDP socket 161 overflow--------OK SNMP

THese errors appears almost the same time evry night.

Regards.

It's probably some "crazy" machine doing network scanning.

I've noticed several times some UNIX and NT servers trying to SNMP scan my network, always around 1:00 a.m.

Have you tried to capture IP packets to see what's happening during that time?

Regards,

Milan

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: