Re: Memory Errors after enabling Access-lists

opiedrah · ‎08-25-2003

After creating an access-list to block port 135 for that MSblaster worm that was going around. The router runs out of memory after a few hours. Router is runing 32MB of DRAM

---------------------------------

Access-List created:

Router(config)#access-list 101 deny tcp any any eq 135

Router(config)#access-list 101 permit tcp any any

Router(config)#access-list 101 permit ip any any

Router(config) interface serial0/0.1

ip access-group 101 in

----------------

And the following error is presented on the Console Screen:

-------- ERROR MESSAGE ---------

2d17h: %SYS-2-MALLOCFAIL: Memory allocation of 5000 bytes failed from

0x803C2E30

, alignment 0

Pool: Processor Free: 115904 Cause: Memory fragmentation

Alternate Pool: None Free: 0 Cause: No Alternate pool

-Process= "IP Input", ipl= 0, pid= 29

-Traceback= 803C6E6C 803C953C 803C2E34 80972384 809724F0 80972ED0

80974330 80969

8B0 8047D080 8047BD7C 8047BF30 8047C080 803E91C4

%% Low on memory; try again later

2d17h: %SYS-2-MALLOCFAIL: Memory allocation of 5000 bytes failed from

0x803C2E30

, alignment 0

Pool: Processor Free: 109060 Cause: Memory fragmentation

Alternate Pool: None Free: 0 Cause: No Alternate pool

-Process= "IP Input", ipl= 0, pid= 29

-Traceback= 803C6E6C 803C953C 803C2E34 80972384 809724F0 80972ED0

80974330 80969

8B0 8047D080 8047BD7C 8047BF30 8047C080 803E91C4

%% Low on memory; try again later

23:28:35: %SYS-2-MALLOCFAIL: Memory allocation of 65536 bytes failed

from 0x803C

2E30, alignment 0

Pool: Processor Free: 88200 Cause: Memory fragmentation

Alternate Pool: None Free: 0 Cause: No Alternate pool

-Process= "IP Input", ipl= 0, pid= 29

-Traceback= 803C6E6C 803C953C 803C2E34 80970604 809745FC 809698B0

8047D080 8047B

D7C 8047BF30 8047C080 803E91C4

23:29:05: %SYS-2-MALLOCFAIL: Memory allocation of 65536 bytes failed

from 0x803C

2E30, alignment 0

Pool: Processor Free: 86372 Cause: Memory fragmentation

Alternate Pool: None Free: 0 Cause: No Alternate pool

-Process= "IP Input", ipl= 0, pid= 29

-Traceback= 803C6E6C 803C953C 803C2E34 80970604 809745FC 809698B0

8047D080 8047B

D7C 8047BF30 8047C080 803E91C4

23:29:36: %SYS-2-MALLOCFAIL: Memory allocation of 65536 bytes failed

from 0x803C

2E30, alignment 0

Pool: Processor Free: 87160 Cause: Memory fragmentation

Alternate Pool: None Free: 0 Cause: No Alternate pool

-Process= "IP Input", ipl= 0, pid= 29

-Traceback= 803C6E6C 803C953C 803C2E34 80970604 809745FC 809698B0

8047D080 8047B

D7C 8047BF30 8047C080 803E91C4

23:30:06: %SYS-2-MALLOCFAIL: Memory allocation of 65536 bytes failed

from 0x803C

2E30, alignment 0

Pool: Processor Free: 85288 Cause: Memory fragmentation

Alternate Pool: None Free: 0 Cause: No Alternate pool

-Process= "IP Input", ipl= 0, pid= 29

-Traceback= 803C6E6C 803C953C 803C2E34 80970604 809745FC 809698B0

8047D080 8047B

D7C 8047BF30 8047C080 803E91C4

23:30:36: %SYS-2-MALLOCFAIL: Memory allocation of 65536 bytes failed

from 0x803C

2E30, alignment 0

Pool: Processor Free: 86072 Cause: Memory fragmentation

Alternate Pool: None Free: 0 Cause: No Alternate pool

-Process= "IP Input", ipl= 0, pid= 29

-Traceback= 803C6E6C 803C953C 803C2E34 80970604 809745FC 809698B0

8047D080 8047B

D7C 8047BF30 8047C080 803E91C4

---------------------

------------------

SH VERSION:

Cisco Internetwork Operating System Software

IOS (tm) C2600 Software (C2600-I-M), Version 12.2(8)T5, RELEASE

SOFTWARE (fc1)

TAC Support: http://www.cisco.com/tac

Compiled Fri 21-Jun-02 08:50 by ccai

Image text-base: 0x80008074, data-base: 0x80A2BD40

ROM: System Bootstrap, Version 12.2(7r) [cmong 7r], RELEASE SOFTWARE

(fc1)

Router uptime is 3 hours, 55 minutes

System returned to ROM by power-on

System image file is "flash:c2600-i-mz.122-8.T5.bin"

cisco 2611XM (MPC860P) processor (revision 0x100) with 27648K/5120K

bytes of mem

ory.

Processor board ID JAD065105JX (2005657956)

M860 processor: part number 5, mask 2

Bridging software.

X.25 software, Version 3.0.0.

2 FastEthernet/IEEE 802.3 interface(s)

1 Serial network interface(s)

32K bytes of non-volatile configuration memory.

16384K bytes of processor board System flash (Read/Write)

---

THANKS IN ADVANCED

deilert · ‎08-25-2003

This is exactly what happened to me. What happened is the router was getting hit so hard the memory got fragmented . You will need to reload to corrrect this , if no one is at the site and you have snmp-server sysyem shutdown configured you can relaod it remoteley with

snmpset ip address .1.3.6.1.4.1.9.2.9.9.0 integer 2

as long as you can ping it , I could ping my routers so I assume you can ping yours.

opiedrah · ‎08-25-2003

Thank you for your reply however reloading a router, is not fix it is a band-aid!

Does any one have any ideas on how to resolve this issue?.

Thanks

bcbvale · ‎08-25-2003

Take the second line out of your access list since the "permit ip" in line three is allowing the "tcp" traffic in line two.

Upgrade your IOS. Whenever possible do not use the "T" train of IOS, unless it has something you need specifically in your environment.

deilert · ‎08-26-2003

Actually the only fix when a router is experiencing MALLOC errors is to reload the router so it is the fix not a band aid. Your memeory got fragmented because of this virus and the only way to correct this is to reload.

Since your were experiencing a virus attack to real'fix' would be to remediate the infected hosts.

opiedrah · ‎08-26-2003

Thanks for your input, i will look further into this issue and design an action plan, Is there a Rule of Thumb or Best practices of how much free memory should be available after the IOS loads into memory?

opiedrah · ‎08-29-2003

We where getting hit by the darn Nachi virus, by blocking ICMP echo and echo-reply on packets biger then 92 bytes the issue was corrected.

http://www.cisco.com/warp/public/707/cisco-sn-20030820-nachi.shtml

bhale · ‎08-29-2003

I've run into this same issue. Reloading the router didn't resolve anything. MALLOC errors started again shortly after the reload.

I RMA'd the memory to correct the issue.

ywai-hung · ‎09-01-2003

I have also same experience, upgrade to 64M SDRAM and IOS can fix it.

Why Cisco not advise it to user about this status

Regards

Hung