Router Log Messages. Help!

[corey.mckinney]

I've been receiving the following messages in my router log and I can't figure out why I'm getting them. Can anyone shed some light on this?

*Jan 16 13:17:00: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor x.x.x.x (Seri

al0/0/0.4) is down: Interface Goodbye received

*Jan 16 13:17:03: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor x.x.x.x (Seri

al0/0/0.4) is up: new adjacency

*Jan 16 13:18:28: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor x.x.x.x (Seri

al0/0/0.4) is down: Interface Goodbye received

*Jan 16 13:18:31: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor x.x.x.x (Seri

al0/0/0.4) is up: new adjacency

*Jan 16 13:19:55: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor x.x.x.x (Seri

al0/0/0.4) is down: Interface Goodbye received

*Jan 16 13:19:59: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor x.x.x.x (Seri

al0/0/0.4) is up: new adjacency

*Jan 16 13:21:23: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor x.x.x.x (Seri

al0/0/0.4) is down: Interface Goodbye received

*Jan 16 13:21:26: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor x.x.x.x (Seri

al0/0/0.4) is up: new adjacency

[mmorris11]

Bad eigrp metrics? Is the serial line bouncing?

[corey.mckinney]

What do mean by bouncing? Traffic is flowing good between the two PVCs. There seems to be nothing wrong with circuit, I'm just getting these messages. The EIGRP settings match on both sides.

[mmorris11]

Hmm. Could it be that you have a unidirectional multicasting problem? Are you getting this in the log on both routers?

[corey.mckinney]

No, just this one router. Is there anything that I can look at in the router config that might be causing this?

[mmorris11]

The problem is most likely that the other side is not recieving the multicast traffic. Have a look at this:

http://www.ciscotaccc.com/kaidara-advisor/iprout/showcase?case=K21076376

[Richard Burts]

Corey

I believe that Mike is on the right track in identifying some problem with EIGRP hellos in one direction. But I do not believe that his suggestion that the other side is not receiving multicast traffic is correct. If it were correct the interval between up and down would be the same and should be the hello timeout period. But if you look at the log records and look closely at the time relationships you find this: initial neighbor going down

then down to up in 3 seconds

up to down in 15 seconds

down to up in 3 seconds

up to down in 1 minute 14 seconds

down to up in 4 seconds

up to down in 1 minute 24 seconds

down to up in 3 seconds.

From this I believe that we can deduce that hellos to this router are reliably being delivered (down to up is always on the next hello transmission) but that hellos from this router to the neighbor are having a problem. The Interface Goodby received is a sign that the neighbor is breaking the neighbor relationship and the fact that the time varies so much is an indication that some hellos are getting through but that others are not. I wonder if there is a congestion problem one way on the connection or perhaps a cable problem (receive lead of the other router or transmit lead of this router).

HTH

Rick

[corey.mckinney]

Each router has 4 PVCs and this is the only PVC that is having this issue, so I don't believe it would be a cable issue. Do you think that distribute filters on the EIGRP AS could be causing this? I noticed that on the EIGRP settings, this PVC has a filter to deny updates that include certain subnets. Would that cause these messages?

[mmorris11]

I wouldn't think that a filter would affect the neighborship. I would recommend running some debugs on the end that does not have the log entry. This side may not be recieving the hello messages or something.

[Richard Burts]

Corey

I do not believe that distribute filters could be causing this. The distribute filter would consistently keep something from being advertised. The symptoms that you describe sound like some hellos are getting through sometimes and are not getting through sometimes. That does not sound like a filter. To me that sounds like a connectivity problem or a congestion problem.

I believe that it might be helpful to do a test. From the router that is reporting the log messages use an extended ping to ping the neighbor address. In the extended ping specify a fairly large number of pings (perhaps 2000 or 3000) and specify a fairly large size (1000 or 1200). Look to see if there is any packet loss in this active ping.

HTH

Rick