Micheal,
Thanks for the info - that does help alot and matches what I'm seeing. I
had no DNS for the switch which explains that. The both routers are
discovered correctly & displayed ok in netview. I have set a name on one of
my switch ports but that doesn't seem to have been written into the standard
MIB anywhere so I'll not expect to see that change in the report output.
Forwarding table (I'm assuming it's dot1dTp?) - not being that familiar with
it, but from looking at it I can see mac addresses of my machines under
oid's within dot1dTpFdbAddress and then the oid indicating the port under
dot1dTpFdbPort dot1dFdbStatus is showing 'learned' for each used port. The
table seems ok and largely matches what the layer2 report is saying.
The only discrepancy seems to be that currently hookipa-w2k (192.168.1.13)
is switched off, but have been previously discovered by Netview and is
reporting down on the topology map - the layer2 report is putting it (with
an *) on port 5. I've picked through the forwarding table and can see a
couple of MAC addresses which are for the two down nodes, but the switch
indicates these are on port 2 not port 5. It seems as though when SA is
considering a node for which it has had a down event it just reports it
against any port rather than the one the switch is saying was the last one
used by that node?
Many thanks again
K
Internet Address Physical Address
192.168.1.1 00-50-7f-05-14-ef
192.168.1.10 00-0d-56-7b-69-7c
192.168.1.14 00-b0-d0-bf-d2-a6
192.168.1.59 00-0c-29-85-f3-63
192.168.1.254 00-0f-20-49-cc-00
17.4.3.1.1.0.12.41.25.17.241 = Hex: 00 0C 29 19 11 F1
17.4.3.1.1.0.12.41.133.243.99 = Hex: 00 0C 29 85 F3 63 (192.168.1.59
- eth1 on on linux router)
17.4.3.1.1.0.13.86.123.105.124 = Hex: 00 0D 56 7B 69 7C (192.168.1.10 -
tiree-w3k)
17.4.3.1.1.0.15.32.73.204.0 = Hex: 00 0F 20 49 CC 00 (192.168.1.254
- the switch)
17.4.3.1.1.0.32.237.84.242.88 = Hex: 00 20 ED 54 F2 58
17.4.3.1.1.0.80.127.5.20.239 = Hex: 00 50 7F 05 14 EF (192.168.1.1 -
router)
17.4.3.1.1.0.160.201.154.2.85 = Hex: 00 A0 C9 9A 02 55 (some machine
I just attached!)
17.4.3.1.1.0.176.208.191.210.166 = Hex: 00 B0 D0 BF D2 A6 (192.168.1.14)
17.4.3.1.2.0.12.41.25.17.241 = 2
17.4.3.1.2.0.12.41.133.243.99 = 5 (192.168.1.59)
17.4.3.1.2.0.13.86.123.105.124 = 5 (192.168.1.10)
17.4.3.1.2.0.15.32.73.204.0 = 0 (192.168.1.254 -
switch's own management ip)
17.4.3.1.2.0.32.237.84.242.88 = 2
17.4.3.1.2.0.80.127.5.20.239 = 24 (192.168.1.1)
17.4.3.1.2.0.160.201.154.2.85 = 15 (some machine I just
attached!)
17.4.3.1.2.0.176.208.191.210.166 = 13 (192.168.1.14)
hookipa/192.168.1.254
[2/2/0.0.0.0] ===>
[jaws-w2k/192.168.1.11 - /0/192.168.1.11]
[5/5/0.0.0.0] ===>
[hookipa-w2k/192.168.1.13 - /0/192.168.1.13] *
[rtr01-vm-ux/172.16.1.1 - eth1/3/192.168.1.59]
[tiree-w3k/192.168.1.10 - Broadcom 570x Gigabit Integrated
Controller/0/192.168.1.10]
[13/13/0.0.0.0] ===>
[webseal01/192.168.1.14 - /0/192.168.1.14]
[24/24/0.0.0.0] ===>
[192.168.1.1/192.168.1.1 - /0/192.168.1.1]
---------------------------------------------------------------------------
Karl Prinelle
Consultant
Elyzium Ltd
Mobile: +44 (0)7813 189198
E-mail: <mailto:karl.prinelle AT elyzium.co DOT uk> karl.prinelle AT
elyzium.co DOT uk
Slough Office, Church Street, Slough, SL1 1PJ. Tel: +44 1753 515000, Fax:+44
1753 515017
Head Office, 12 Queensbrook, Bolton, BL1 4AY. Tel: +44 1204 528628, Fax: +44
1204 534678
For further information, please visit our website at
<http://www.elyzium.co.uk/> www.elyzium.co.uk
---------------------------------------------------------------------------
Elyzium Disclaimer:
This email transmission is confidential and intended solely for the person
or organisation to whom it is addressed. If you are not the intended
recipient, you must not copy, distribute or disseminate the information, or
take any action in reliance of it. Any views expressed in this message are
those of the individual sender, except where the sender specifically states
them to be the views of any organisation or employer.
If you have received this message in error, do not open any attachment
but please notify the sender (above) deleting this message from your system.
Please rely on your own virus check no responsibility is taken by the
sender for any damage arising out of any bug or virus infection.
---------------------------------------------------------------------------
_____
From: owner-nv-l AT lists.us.ibm DOT com [mailto:owner-nv-l AT lists.us.ibm DOT
com] On
Behalf Of Michael Webb
Sent: 10 June 2004 22:25
To: nv-l AT lists.us.ibm DOT com
Subject: Re: [nv-l] itsl2_reports output format?
I will ask a few questions of my own to help get this thread moving along.
I will try to answer some of your questions first. In general, however, it
looks like there are discovery issues with the switch 192.168.1.254 (HP
Procurve 2524).
192.168.1.254/192.168.1.254
This is the output of the switch hostname name followed by the IP address of
the management IP. However, it looks as if DNS did not resolve the IP
address to a hostname, so the IP address was used in place of the hostname.
That is why you see the IP address twice.
[2/2/0.0.0.0]
This output is usually the port description followed by the ifindex (or
port) followed by the IP address of the port. The first 2 is the
description provided by the switch (via some SNMP query). The second 2 is
the ifindex (or port). The 0.0.0.0 is the IP address of the port. In the
case of a switch port, it does not have an IP address, so 0's are used by
default.
[5/5/0.0.0.0]
In most case there is something you can do to help the ITSA discovery
process provide better results and remove the * from the discovery report.
First you should remember that NetView will need to correctly discover the
devices attached to each of the switch ports. So answering these questions
may help.
Is router 192.168.1.1 correctly discovered by NetView to be a router (router
icon in map)? Does NetView have the community string for this router?
Is the Linux router discovered as a router on the NetView map? Does NetView
have the community string of this Linux router?
Is PC 192.168.1.14 discovered by NetView to be a workstation? Does NetView
know the community string of the PC?
When you manually query the HP Procurve for the Bridge MIB, do you see the
correct (expected) information for the forwarding tables?
Hope this helps.
Michael Webb, IBM Tivoli
Q1CA Distributed NetView / ITSA SVT
Email: mlwebb AT us.ibm DOT com
Ext: (919) 224-1410, T/L: 687-1410
Inactive hide details for "Karl Prinelle" <Karl.Prinelle AT elyzium.co DOT
uk>"Karl
Prinelle" <Karl.Prinelle AT elyzium.co DOT uk>
"Karl Prinelle" <Karl.Prinelle AT elyzium.co DOT uk>
Sent by: owner-nv-l AT lists.us.ibm DOT com
06/10/2004 12:15 PM
Please respond to nv-l
To: <nv-l AT lists.tivoli DOT com>
cc:
Subject: [nv-l] itsl2_reports output format?
Hi list,
nv 7.1.4+fp1, sa 1.2.1, linux rh es 2.1, HP Procurve 2524 with single vlan
called VLAN1.
I'm doing a little testing with switch analyser & although the brain maybe
clogged by hayfever I can't find a document that describes the output from
"ITSL2_reports -r layer2 -d". If anyone can point me to doc's on this that
would be great. Just in case below is the output I'm getting;
192.168.1.254/192.168.1.254
[2/2/0.0.0.0] ===>
[jaws-w2k/192.168.1.11 - /0/192.168.1.11]
[5/5/0.0.0.0] ===>
[172.16.1.1/172.16.1.1 - eth1/3/192.168.1.59]
[192.168.1.1/192.168.1.1 - /0/192.168.1.1] *
[tiree-w2k3/192.168.1.10 - /0/192.168.1.10]
[ws01/192.168.1.14 - /0/192.168.1.14] *
* This interface has been placed on the layer 2 segment by "default" and
is not necessarily connected to the specified port.
192.168.1.1 is a router which is connect to an HP Procurve 2524
(192.168.1.254 mgmt ip) on port 24 of the switch
192.168.1.14 is a pc attached to port 13 of the switch
172.16.1.1 & 192.168.1.59 are interfaces on a linux router
172.16.1.202 is the netview server
The Linux router and netview server are both vmware images running on the
host 192.168.1.10
A few questions to get me going....;
192.168.1.254/192.168.1.254 => what is this telling me? My switch ipaddr is
192.168.1.254 - but why print it twice?
[2/2/0.0.0.0] => Just plain confused. This device is in port 2 of my switch,
but why print that twice? What's the 0.0.0.0?
[5/5/0.0.0.0] => is there anything I can do to remove the * from 192.168.1.1
and 192.168.1.14 which are both real machines plugged into different ports
on the switch & get them reporting the correct port numbers?
Any help much appreciated
K
|
