My netmon expert confirms that netmon will send an ICMP Address Mask request to a node when it does not have SNMP access to the
IPAddrTable and the IfTable. And that the request will be sent at (1) initial discovery, (2) the daily config poll, and (3) demand poll.

But why you should see the NetView machine send an ICMP Address Mask reply puzzles me. A reply would indicate that another machine sent the request to the NetView machine. And it would not be NetView's job to reply but rather the host OS's job to respond to that ping.

I'm also curious as to what prompted this question. How would you happen to notice this traffic? What are you doing? Sniffing packets in order to discover the details of the discovery process? :-)

That's up to you I guess But it's proprietary and we deliberately don't publish much about it.

James Shanks
Tivoli Network Availability Management Level Three
Network Availability Management
Tivoli Software, IBM Corp
1-919-224-1642 | T/L 687-1642 | ITN 26871642
Francois Le Hir <flehir AT ca.ibm DOT com>

Francois Le Hir <flehir AT ca.ibm DOT com> Sent by: nv-l-bounces AT lists.ca.ibm DOT com 02/25/2009 02:02 PM Please respond to Tivoli NetView Discussions <nv-l AT lists.ca.ibm DOT com>

To Tivoli NetView Discussions <nv-l AT lists.ca.ibm DOT com> cc Subject Re: [NV-L] NetView sending ICMP Address Mask replies

yes it's part of the discovery process. I believe it does that when there is no snmp access and it tries to find the subnet mask for the interfaces.

Salutations, / Regards,

Francois Le Hir
Network Projects & Consulting Services
IBM Global Technology Services

"Do not go where the path may lead; go instead where there is no path and leave a trail." - Ralph Waldo Emerson.
"Sperry, Kevin" <Kevin.Sperry AT us.ngrid DOT com>

"Sperry, Kevin" <Kevin.Sperry AT us.ngrid DOT com> Sent by: nv-l-bounces AT lists.ca.ibm DOT com 02/25/2009 01:23 PM Please respond to Tivoli NetView Discussions <nv-l AT lists.ca.ibm DOT com>

To "Tivoli NetView Discussions" <nv-l AT lists.ca.ibm DOT com> cc Subject [NV-L] NetView sending ICMP Address Mask replies

Hello again,

Using NetView 7.1.5 FP1 on AIX and noticed that for a brief period last evening, NetView was sending ICMP Address Mask replies to a couple of hosts. They have stopped now. Why would NetView send this type of ICMP out to known hosts? Is it part of the discovery process?

Any insight would be greatly appreciated as always.

Kevin Sperry
IT Analyst, Data Center Monitoring Control

********************************************************************************
This e-mail and any files transmitted with it, are confidential to National Grid and are intended solely for the use of the individual or entity to whom they are addressed.  If you have received this e-mail in error, please reply to this message and let the sender know._______________________________________________
NV-L mailing list
NV-L AT lists.ca.ibm DOT com
Unsubscribe:NV-L-leave AT lists.ca.ibm DOT com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to internal IBM'ers only)_______________________________________________
NV-L mailing list
NV-L AT lists.ca.ibm DOT com
Unsubscribe:NV-L-leave AT lists.ca.ibm DOT com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to internal IBM'ers only)

_______________________________________________
NV-L mailing list
NV-L AT lists.ca.ibm DOT com
Unsubscribe:NV-L-leave AT lists.ca.ibm DOT com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to 
internal IBM'ers only)