Welcome, Guest. Please login or register.

Author Topic: Two Cisco switches showing no traffic  (Read 2488 times)

sjwk

  • Newbie
  • *
  • Posts: 37
    • View Profile
Two Cisco switches showing no traffic
« on: January 23, 2014, 06:58:24 PM »
Weird one here.  I have two switches (one last Cisco 2900, one 2960) showing no traffic on any port in the Device-Status view.  Ignoring the 2900 as it's about to be replaced, and probably isn't set up right, all other 2960s work fine and are, on the whole, identically configured (same credentials, same SNMP).  While not all switches are running the exact same version of IOS (12.2.55), there are two others running that same version.

All other data on the misbehaving 2960 is there - it shows interfaces as active, lists the devices connected, shows CDP neighbours and VLANs etc.  But the inbound/outbound counters for all interfaces on that switch just show as zero, and consequently the active interfaces report shows all ports as inactive (as that appears to use traffic to distinguish active vs inactive). If I launch the realtime traffic graph popup for one of the ports, it shows live traffic data.  Looking at the interface stats on the switch shows incrementing counts.

Actually, the values for in/out octets, errors and discards are all zero (although there may be no errors/discards in the 10 minute poll interval), although the broadcast counter does show values.

Any suggestions where to look to see why this particular switch is not playing ball?


rickli

  • Administrator
  • Hero Member
  • *****
  • Posts: 2701
    • View Profile
    • NeDi
Re: Two Cisco switches showing no traffic
« Reply #1 on: January 23, 2014, 08:24:13 PM »
Is it really set to SNMP v2? (Devices-Status or Devices-List should show 2HC, actually). HC means 64bit counters, which you need on Gigabit devices to avoid overruns. I've added a button next to the SNMP version select box, to test HC counters as well.

If the above is true, discover it with -v (Radar icon in Devices-Status will do). Do you see any "ERR : " lines in the interface section?

This is a successful result:
SNMP:Connect 10.10.10.4 public v2 Tout:5s MaxMS:1472
IF  :Walking high-speed
IF  :Walking 64bit counters
IF  :Walking errors
IF  :Walking discards
IF  :Walking in-broadcasts
Please consider Other-Invoices on your NeDi installation for an annual contribution, tx!
-Remo

sjwk

  • Newbie
  • *
  • Posts: 37
    • View Profile
Re: Two Cisco switches showing no traffic
« Reply #2 on: January 24, 2014, 10:04:56 AM »
Thanks, that's pointed me at the right part of the output!
As you suspected, it is generating errors:
ERR :64bit-in The requested entries are empty or do not exist

Ah.  it also does seem to be connecting with SNMP v1, which is decidedly odd, as the device definition wants to use v2HC - it's the exact same definition as used on all the other identical Cisco 2960s, and those are connecting with v2.  The SNMP configuration is identical on the switches themselves.  If I use the 'test 64bit counters' on that switch in the 'edit def file' view from that switch, it works fine, so it just seems to be the scheduled discovery task that is wrongly using v1.

Update:
Looking in the database, the snmpversion value for both of these switches is 129, while all other switches have 130.  Also noted that the 2900 doesn't support 64bit counters - or at least the 64 bit counter test gave no values for that switch (like I say, don't care about that one)

Speculation: this particular 2960 replaced an old 2900, although different model, MAC address, serial number and probably name (can't remember whether I had renamed the old one before it was replaced).  Would that account for it?  Perhaps if it already had a database entry telling it to use v1 for that IP, it continued to do so even after the switch was replaced?  Strange thing is, I replaced 4 old switches with new 2960s and this is the only one misbehaving.

I've just deleted the switch from Nedi, will see if it is working after the next scan.

Thanks for the help.
« Last Edit: January 24, 2014, 10:15:45 AM by sjwk »

sjwk

  • Newbie
  • *
  • Posts: 37
    • View Profile
Re: Two Cisco switches showing no traffic
« Reply #3 on: January 24, 2014, 11:20:02 AM »
Just an update that deleting the device caused it to start using SNMP v2.  Worth bearing in mind that it's a good idea to delete devices if they've been replaced with different models!

rickli

  • Administrator
  • Hero Member
  • *****
  • Posts: 2701
    • View Profile
    • NeDi
Re: Two Cisco switches showing no traffic
« Reply #4 on: January 24, 2014, 04:34:44 PM »
NeDi uses the sysname as primary key, so yes this makes sense. In rare cases the switch doesn't respond fast enough to v2, NeDi may set it to v1 upon 1st discovery. If a device exists already, the version will not be changed (was the case in earlier NeDi releases).
Please consider Other-Invoices on your NeDi installation for an annual contribution, tx!
-Remo