01-02-2003 08:34 AM - edited 03-02-2019 03:53 AM
Hello,
Currently getting %IP-3-UDP_SOCKOVFL: UDP socket 161 overflow messages from 4000 and 6509 switches.
4000 =version 6.2(2)
6509= version 6.2(3)
Anyway of stopping these ?
01-02-2003 08:45 AM
I have the same problem with 5000 series switches. I think Bug ID
CSCdz55568 may be related to your issue
01-02-2003 05:42 PM
Using the IOS Error Message Decoder Tool on CCO:
http://www.cisco.com/cgi-bin/Support/Errordecoder/home.pl
The above message has the following details:
'1. %IP-3-UDP_SOCKOVFL: UDP socket [dec] overflow
This message indicates that all buffers for a UDP socket on the NMP have filled up due to excessive UDP traffic on the administrative VLAN. The system may be under attack or an network management application might be out of control. [dec] is the UDP socket number.
Recommended Action: You could remove or block the source of the UDP packets to prevent further UDP packet loss, or use a network analyzer to identify the source of the traffic. '
01-03-2003 04:47 AM
Dont think system is under attack, problem seems to be with different polling intervals set with RME, DFM , Campus Mgr components, currently the setting are as below monitoring situation to see if problem regenerates.
RME->Administration->Availability-Change Polling Options
Poll Reload & Protocol Distribution Every 2 Hours
Verify Status Interface Every 60 Minutes
Verify Device Reachability Every 15 Minutes
Campus Manager->Topology Map Discovery
SNMP Polling Frequency Every 300 Seconds
(used to be 60 seconds)
Device Fault Manager Rediscovery schedule Every Friday 12:00pm
Server Configuration->Setup->Discover Schedule
Hours Minutes
Discovery Mon-Sun 5 00
Polling Every 0 10
Settings Before :-
Discover Schedule
Mon-Sun Hours Minutes
0 00
4 00
8 00
12 00
16 00
20 00
Polling Every 0 5
03-16-2003 10:56 PM
Hi,
I've got the same problem with 6509 switches. But error messages varies between devices, onsome of them:
%IP-3-UDP_SOCKOVFL: UDP socket 1139 overflow-------???
On the others:
%IP-3-UDP_SOCKOVFL: UDP socket 161 overflow--------OK SNMP
THese errors appears almost the same time evry night.
Regards.
03-17-2003 03:51 AM
It's probably some "crazy" machine doing network scanning.
I've noticed several times some UNIX and NT servers trying to SNMP scan my network, always around 1:00 a.m.
Have you tried to capture IP packets to see what's happening during that time?
Regards,
Milan
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: