RE: [nv-l] how does netmon interact with the ARP cache?

Thanks for all the advice, I’ll check into all this stuff.

From: Barr, Scott [mailto:owner-nv-l AT lists.us.ibm DOT com] On Behalf Of Barr, Scott
Sent: Friday, October 08, 2004 8:03 AM
To: nv-l AT lists.us.ibm DOT com
Subject: RE: [nv-l] how does netmon interact with the ARP cache?

Keep in mind, netmon has a list of things to check status on. If you only had one node discovered, and it was on a 1 second status poll (theoretical, don't really try that) it would notice much faster than if it were on a 3 minute poll with 100 nodes.

Netmon would definately notice it up at the next schedule poll of the device. There is a netmon command to dump the ping list (and the SNMP list) to see if you are backing up on status polls or whether you've got cycles to spare. The man page for netmon has the proper flag (netmon -a 11 / 12 are for ping lists) if you issue netmon -a 12 and then look at the netmon.trace file, it will tell you how many nodes are in line to be pinged.

We've all observed the behavior you are describing, but it is usually attributed to being anxious to see the node turn green again. Now, if the status poll time passes, and the node doesn't turn green, then you do have a problem. If you want to know when the next status poll for a node occurs, use ovtopodump -rl <resourcename>.

Hope that helps.

Scott Barr

Distributed Network Engineer

CSG Systems Inc.

Phone: 402-431-7939

Fax: 402-431-7413

scott_barr AT csgsystems DOT com

From: owner-nv-l AT lists.us.ibm DOT com on behalf of Freeman, Michael
Sent: Thu 10/7/2004 7:42 PM
To: nv-l AT lists.us.ibm DOT com
Subject: RE: [nv-l] how does netmon interact with the ARP cache?

If this is the case, then how come in my simulations when I start an agent, and then netview notices its down, then I turn it back up, if I ping it right away the object in netview changes status, if not, it will eventually pick it up when “it feels like it”

From: owner-nv-l AT lists.us.ibm DOT com [mailto:owner-nv-l AT lists.us.ibm DOT com] On Behalf Of Barr, Scott
Sent: Thursday, October 07, 2004 12:52 PM
To: nv-l AT lists.us.ibm DOT com
Subject: RE: [nv-l] how does netmon interact with the ARP cache?

The arp cache will only store the mac address of the local router that is forwarding packets on behalf of the IP address you are interested. The real mac address is not present in the arp table on the router (unless by coincidence, the router has another interface into the subnet where the device actually resides). I believe the same would be true for the netview box’s arp cache – it’s going to reflect the mac address of the device local to the NetView server (such as the local router) that can reach the end device IP address.

Short answer: I don’t think arp cache has anything to do with it. I could be wrong.

From: owner-nv-l AT lists.us.ibm DOT com [mailto:owner-nv-l AT lists.us.ibm DOT com] On Behalf Of Freeman, Michael
Sent: Thursday, October 07, 2004 12:25 PM
To: nv-l AT lists.us.ibm DOT com
Subject: [nv-l] how does netmon interact with the ARP cache?

I have noticed that if a device goes down, and then comes back up before netmon “magically notices it”, if you ping the device, the object status will change in NetView. I assume this is because NetView is somehow monitoring the arp tables? We are using NetView 7.1.3 on Solaris and I am kind of curious to know how netmon and the arp cache works. It seemed like in my tests with my network simulator, If I took down 200 nodes, and then brought them up before netmon’s polling cycle kicked in, that if I pinged every one of them (with a script of course), about only 10 or so nodes would immediately have their object status changed in NetView. How does netmon divvy up the workload? Helper threads? Timeslicing ?

*** Note new e-mail address

Michael J. Freeman

Netco Government Services

mfreeman AT netcogov DOT com