IBM Support

IV00342: NCP_TRAPMUX FORWARDS TRAP PACKETS USING INCORRECT LENGTH

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • When routing snmp traps through the ncp multiplexor
    it appears that while it will receive the trap ok it only will
    forward out 1024 bytes. If the trap is longer than
     that it just truncates the trap
    
    
    Errors in debug log:
    2011-03-28T18:39:34: Warning: W-MOM-001-007: [1t] Broker error
    on  receive:
    2011-03-28T18:39:34: Warning: W-MOM-001-031: [1t] Broker
    disconnection
    detected, reconnecting ...
    2011-03-28T18:39:34: Warning: W-MOM-001-014: [1t] Failed to
    connect to
    broker:  127.0.0.1:1883 clientId: ncp_trapmux_844030_WLPITNM :
    Unexpected
    error code
    2011-03-28T18:39:34: Information: I-MOM-001-034: [1t] Attempting
    to
    start message broker.
    04/28/11 13:57:36: Information: [1t] Logging for ncp_trapmux
         initialised at level 'debug'
    04/28/11 13:57:36: Debug: [1t] Logging for ncp_trapmux to file:
        /tmp/muxout.log
    04/28/11 13:57:36: Information: [1t] ncp_trapmux[512188]
         Version 3.8 (Build 69) becoming Primary
    04/28/11 13:57:36: Warning: Failed to load IP address network
    module
    'ipv6_r'. (-60:Unknown error -60)
    ncp_trapmux: large traps which are sent to the multiplexer and
    are fragmented are not being processed correctly.   No
    information is
    shown in logs.  tcpdump shows that the trap was received by the
    host.
    We had the probe set to run under ncosys with setid.
    We also ran it under root and piped the 1 and 2 output to the
    trace file.
    ncp_trapmux -domain WLPITNM 1>
    /opt/IBM/tivoli/itnm/netcool/log/precision/ncp_trapmux.WLPITNM.t
    race 2>&1
    Sent a short trap that goes through fine.
    Started a tcpdump to a capture file.
    Sent the short trap again.
    Sent the large trap which failed.
    Then sent the short trap again.
    muxlocal5.cap has the tcpdump.  The send is from 149.131.xxx.xxx
    to
        mux on 149.131.yyy.yyy which should send back to .xxx.
    (Packet 1)
    In the snoop, you can see the short trap coming in is fine and
    going
        out it shows as a udp packet with the zero fill.   (packet
    2)
    The long trap coming in looks fine as an snmp trap. (packet 13)
    Going out it is a single udp packet truncated at 1024 (packet
    14)
    The config has:
     insert into trapMux.sinkHosts values("va1001.tivoli.com",162);
    We sent a trap using: snmptrap -h 149.131.ccc.dd -m 'Test small
    trap'
    It goes through to the va1001 with no problem but the
    /tmp/muxout.log
    does not get any updates.
    I tried running the kill -USR2, running another trap through 4
    iterations
    and there was no difference in the logging.
    
    We sent a large trap and it did not get through to the probe.
    ./ncp_trapmux -domain WLPITNM -debug 4 -messagelevel debug
    -messagelo
    /tmp/muxout.log 2&>1 >/tmp/stdmux.log &
    When the large trap, this is what I capture:
    CTrapPacketHolder::TPHDumpData()
    30 82 07 fc 02 01 00 04 06 70 75 62 6c 69 63 a4
    82 07 ed 06 08 2b 06 01 04 01 a8 71 04 40 04 1e
    16 4b b2 02 01 06 02 01 09 43 04 25 06 cb 18 30
    82 07 cd 30 34 06 09 2b 06 01 04 01 a8 71 04 01
    04 27 54 65 73 74 20 6c 6f 6e 67 20 74 72 61 70
    20 66 6f 72 20 4b 65 6e 20 74 6f 20 31 34 39 2e
    31 33 31 2e 32 36 2e 32 30 30 31 06 09 2b 06 01
    04 01 a8 71 04 02 04 24 65 50 6f 72 74 61 6c 5f
    50 72 6f 76 69 64 65 72 5f 4d 65 64 69 63 61 6c
    5f 42 43 43 2d 2d 46 41 49 4c 45 44 30 1a 06 09
    2b 06 01 04 01 a8 71 04 03 04 0d 52 65 67 75 6c
    61 72 20 41 6c 65 72 74 30 4d 06 09 2b 06 01 04
    01 a8 71 04 04 04 40 33 35 36 34 33 35 33 36 33
    37 33 34 33 36 33 34 36 34 33 32 36 32 36 31 36
    34 36 34 36 31 36 33 33 36 33 32 36 35 33 32 36
    31 33 35 33 30 33 39 36 31 33 35 33 33 33 39 33
    36 33 35 33 35 33 37 30 0e 06 09 2b 06 01 04 01
    a8 71 04 05 02 01 32 30 81 d8 06 09 2b 06 01 04
    01 a8 71 04 06 04 81 ca 46 6f 72 20 74 72 61 6e
    73 61 63 74 69 6f 6e 20 22 65 50 6f 72 74 61 6c
    5f 50 72 6f 76 69 64 65 72 5f 4d 65 64 69 63 61
    6c 5f 42 43 43 2d 2d 45 6c 69 67 69 62 69 6c 69
    74 79 5f 41 6e 64 5f 42 65 6e 65 66 69 74 73 5f
    54 61 62 22 20 2e 20 52 65 73 70 6f 6e 73 65 20
    74 69 6d 65 20 66 6f 72 20 32 20 6f 75 74 20 6f
    66 20 32 20 74 72 61 6e 73 61 63 74 69 6f 6e 73
    20 77 6f 72 73 65 20 74 68 61 6e 20 4d 69 6e 6f
    72 2f 43 72 69 74 69 63 61 6c 20 74 68 72 65 73
    68 6f 6c 64 20 6c 65 76 65 6c 3b 20 20 54 72 65
    61 74 20 74 68 72 65 73 68 6f 6c 64 20 76 61 6c
    75 65 20 61 73 20 30 2e 30 30 25 20 77 6f 72 73
    65 2e 30 81 8d 06 09 2b 06 01 04 01 a8 71 04 07
    04 81 7f 52 65 73 70 6f 6e 73 65 20 74 69 6d 65
    20 66 6f 72 20 32 20 6f 75 74 20 6f 66 20 32 20
    74 72 61 6e 73 61 63 74 69 6f 6e 73 20 77 61 73
    20 77 6f 72 73 65 20 74 68 61 6e 20 4d 69 6e 6f
    72 2f 43 72 69 74 69 63 61 6c 20 74 68 72 65 73
    68 6f 6c 64 20 6c 65 76 65 6c 3b 20 20 54 72 65
    61 74 20 74 68 72 65 73 68 6f 6c 64 20 76 61 6c
    75 65 20 61 73 20 30 2e 30 30 25 20 77 6f 72 73
    65 2e 30 5d 06 09 2b 06 01 04 01 a8 71 04 08 04
    50 52 75 6e 42 6f 6f 6b 3a 50 72 6f 76 69 64 65
    72 5f 65 50 6f 72 74 61 6c 2d 2d 55 52 4c 3a 68
    74 74 70 73 3a 2f 2f 70 72 6f 76 69 64 65 72 32
    2e 61 6e 74 68 65 6d 2e 63 6f 6d 2f 77 70 73 2f
    6d 79 70 6f 72 74 61 6c 2f 65 62 70 6d 79 62 63
    63 30 10 06 0b 2b 06 01 04 01 a8 71 04 09 01 01
    02 01 1f 30 10 06 0b 2b 06 01 04 01 a8 71 04 0a
    01 01 02 01 1f 30 10 06 0b 2b 06 01 04 01 a8 71
    04 0a 01 02 02 01 1f 30 81 da 06 0b 2b 06 01 04
    01 a8 71 04 0a 01 03 04 81 ca 46 6f 72 20 74 72
    61 6e 73 61 63 74 69 6f 6e 20 22 65 50 6f 72 74
    61 6c 5f 50 72 6f 76 69 64 65 72 5f 4d 65 64 69
    63 61 6c 5f 42 43 43 2d 2d 45 6c 69 67 69 62 69
    6c 69 74 79 5f 41 6e 64 5f 42 65 6e 65 66 69 74
    73 5f 54 61 62 22 20 2e 20 52 65 73 70 6f 6e 73
    65 20 74 69 6d 65 20 66 6f 72 20 32 20 6f 75 74
    20 6f 66 20 32 20 74 72 61 6e 73 61 63 74 69 6f
    6e 73 20 77 6f 72 73 65 20 74 68 61 6e 20 4d 69
    6e 6f 72 2f 43 72 69 74 69 63 61 6c 20 74 68 72
    65 73 68 6f 6c 64 20 6c 65 76 65 6c 3b 20 20 54
    72 65 61 74 20 74 68 72 65 73 68 6f 6c 64 20 76
    61 6c 75 65 20 61 73 20 30 2e 30 30 25 20 77 6f
    72 73 65 2e 30 81 8f 06 0b 2b 06 01 04 01 a8 71
    
    TrapMuxDaemon::ReceiveTrapPacket().
    TrapMuxDaemon::ReceiveTrapPacket().
    

Local fix

Problem summary

  • ****************************************************************
    * USERS AFFECTED:                                              *
    * Anyone running the ncp_trapmux daemon                        *
    ****************************************************************
    * PROBLEM DESCRIPTION:                                         *
    * ncp_trapmux forwards traps as 1024 byte packets, regardless  *
    * of the size of the inbound packet                            *
    ****************************************************************
    * RECOMMENDATION:                                              *
    * This fix will be included in | fix pack |                    *
    * 3.8.0-ITNMIP-FP0007 and | fix pack | 3.9.0-ITNMIP-FP0001     *
    ****************************************************************
    ncp_trapmux forwards traps as 1024 byte packets, regardless of
    the size of the inbound packet.  Packets larger than 1024 bytes
    are truncated.  Smaller packets are zero-padded out to 1024
    bytes.
    

Problem conclusion

  • | fix pack | 3.8.0-ITNMIP-FP0007 and | fix pack |
    3.9.0-ITNMIP-FP0001
    

Temporary fix

Comments

APAR Information

  • APAR number

    IV00342

  • Reported component name

    TIV NETWK MGR I

  • Reported component ID

    5724S4500

  • Reported release

    380

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2011-05-11

  • Closed date

    2011-05-25

  • Last modified date

    2011-05-25

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    TIV NETWK MGR I

  • Fixed component ID

    5724S4500

Applicable component levels

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSSHRK","label":"Tivoli Network Manager IP Edition"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"380","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
24 August 2023