No worries. Ok, here is one example of the problem. I receive a trap
from device cmpatl01.atl.cmp.com, then my machine tries to immediately
do an ICMP back to that machine. Thanks, James
12:48:37.149389 cmpatl01.atl.cmp.com.snmptrap > 192.168.1.18.snmptrap:
[udp sum ok] { SNMPv1 { Trap(253) E:excelan.2.34 10.65.225.21
enterpriseSpecific[specific-trap(100)!=0] 16426830
E:excelan.2.34.1.1=1069782562 E:excelan.2.34.1.2=134
E:excelan.2.34.1.3=-603
E:excelan.2.34.1.4=".MLK0272.RUT.ATL.TP.TEN.CMP."
E:excelan.2.34.1.41=-766286752 E:excelan.2.34.1.42=561
E:excelan.2.34.1.28=3 E:excelan.2.34.1.6=".Adobe 50
Full.ZFD_APPS.TP.TEN.CMP." E:excelan.2.34.1.11=""} } (ttl 121, id 5042,
len 299)
0x0000 4500 012b 13b2 0000 7911 7fff 0a41 e115 E..+....y....A..
0x0010 c0a8 0112 00a2 00a2 0117 6355 3082 010b ..........cU0...
0x0020 0201 0004 0670 7562 6c69 63a4 81fd 0608 .....public.....
0x0030 2b06 0104 0117 0222 4004 0a41 e115 0201 +......"@..A....
0x0040 0602 0164 4304 00fa a74e 3081 de30 1206 ...dC....N0..0..
0x0050 0a2b 0601 0401 1702 2201 0102 043f c396 .+......"....?..
0x0060 2230 1006 0a2b 0601 0401 1702 2201 0202 "0...+......"...
0x0070 0200 8630 1006 0a2b 0601 0401 1702 2201 ...0...+......".
0x0080 0302 02fd a530 2a06 0a2b 0601 0401 1702 .....0*..+......
0x0090 2201 0404 1c2e 4d4c 4b30 3237 322e 5255 ".....MLK0272.RU
0x00a0 542e 4154 4c2e 5450 2e54 454e 2e50 4341 T.ATL.TP.TEN.CMP
0x00b0 2e30 1206 0a2b 0601 0401 1702 2201 2902 .0...+......".).
0x00c0 04d2 5364 6030 1006 0a2b 0601 0401 1702 ..Sd`0...+......
0x00d0 2201 2a02 0202 3130 0f06 0a2b 0601 0401 ".*...10...+....
0x00e0 1702 2201 1c02 0103 3031 060a 2b06 0104 ..".....01..+...
0x00f0 0117 0222 0106 0423 2e41 646f 6265 2035 ..."...#.Adobe.5
0x0100 3020 4675 6c6c 2e5a 4644 5f41 5050 532e 0.Full.ZFD_APPS.
0x0110 5450 2e54 454e 2e50 4341 2e30 0e06 0a2b TP.TEN.CMP.0...+
0x0120 0601 0401 1702 2201 0b04 00 ......"....
12:48:37.149507 192.168.1.18 > cmpatl01.atl.cmp.com: icmp: 192.168.1.18
udp port snmptrap unreachable for cmpatl01.atl.cmp.com.snmptrap >
192.168.1.18.snmptrap: [udp sum ok] { SNMPv1 { Trap(253)
E:excelan.2.34 10.65.225.21 enterpriseSpecific[specific-trap(100)!=0]
16426830 E:excelan.2.34.1.1=1069782562 E:excelan.2.34.1.2=134
E:excelan.2.34.1.3=-603
E:excelan.2.34.1.4=".MLK0272.RUT.ATL.TP.TEN.CMP."
E:excelan.2.34.1.41=-766286752 E:excelan.2.34.1.42=561
E:excelan.2.34.1.28=3 E:excelan.2.34.1.6=".Adobe 50
Full.ZFD_APPS.TP.TEN.CMP." E:excelan.2.34.1.11=""} } (ttl 121, id 5042,
len 299) [tos 0xc0] (ttl 64, id 22634, len 327)
0x0000 45c0 0147 586a 0000 4001 737b c0a8 0112 E..GXj..@.s{....
0x0010 0a41 e115 0303 ab36 0000 0000 4500 012b .A.....6....E..+
0x0020 13b2 0000 7911 7fff 0a41 e115 c0a8 0112 ....y....A......
0x0030 00a2 00a2 0117 6355 3082 010b 0201 0004 ......cU0.......
0x0040 0670 7562 6c69 63a4 81fd 0608 2b06 0104 .public.....+...
0x0050 0117 0222 4004 0a41 e115 0201 0602 0164 ..."@..A.......d
0x0060 4304 00fa a74e 3081 de30 1206 0a2b 0601 C....N0..0...+..
0x0070 0401 1702 2201 0102 043f c396 2230 1006 ...."....?.."0..
0x0080 0a2b 0601 0401 1702 2201 0202 0200 8630 .+......"......0
0x0090 1006 0a2b 0601 0401 1702 2201 0302 02fd ...+......".....
0x00a0 a530 2a06 0a2b 0601 0401 1702 2201 0404 .0*..+......"...
0x00b0 1c2e 4d4c 4b30 3237 322e 5255 542e 4154 ..MLK0272.RUT.AT
0x00c0 4c2e 5450 2e54 454e 2e50 4341 2e30 1206 L.TP.TEN.CMP.0..
0x00d0 0a2b 0601 0401 1702 2201 2902 04d2 5364 .+......".)...Sd
0x00e0 6030 1006 0a2b 0601 0401 1702 2201 2a02 `0...+......".*.
0x00f0 0202 3130 0f06 0a2b 0601 0401 1702 2201 ..10...+......".
0x0100 1c02 0103 3031 060a 2b06 0104 0117 0222 ....01..+......"
0x0110 0106 0423 2e41 646f 6265 2035 3020 4675 ...#.Adobe.50.Fu
0x0120 6c6c 2e5a 4644 5f41 5050 532e 5450 2e54 ll.ZFD_APPS.TP.T
0x0130 454e 2e50 4341 2e30 0e06 0a2b 0601 0401 EN.CMP.0...+....
0x0140 1702 2201 0b04 00 .."....
On Wed, 2003-11-26 at 09:34, Leonard Miller wrote:
> Sorry, I wasn't paying attention.
> You should be able to save the packets to filename.cap
> then do a "tcpdump -r filename.cap -vvvX"
> Copy the info from the screen and put in a message.
> Is one of the packets an ACK? You should be able to tell if one is a
> response to the other.
>
>
> >>> jamesredhatlist@xxxxxxxxxxxxxxxx 11/26/03 08:38AM >>>
> <bump>
>
> On Tue, 2003-11-25 at 13:53, James Pifer wrote:
> > Not sure how to send on of the packets. You're right about the port.
> The
> > src and dest port of the 'destination unreachable' packet is
> snmptrap
> > 162.
> >
> > What I don't get is why my machine is trying to send something back
> to
> > the one that sent the snmptrap.
> >
> > >From ethereal, how can I send one the packets?
> >
> > Thanks,
> > James
> >
> > On Tue, 2003-11-25 at 13:08, Leonard Miller wrote:
> > > Can you send one of the packets? It is probably just trying to
> reach a
> > > port
> > > that is not listening.
> > >
> > > Leonard
--
redhat-list mailing list
unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list
