From: murakami@ntt-20.ntt.jp
Newsgroups: comp.protocols.snmp
Subject: Re: How can I fix a HP Open View's bug? (burst packets)
Date: 18 Aug 92 15:41:46 GMT
Reply-To: murakami@ntt-20.ntt.jp
Distribution: comp
Organization: NTT Basic Research Laboratories NUE Group
Posting-Front-End: TAO/ELIS Znews, Version 0.13, 9-May-91; Vanadium.NTT.JP

Michael,

>|> we tried to find the object ID internet.4.1.11.2.13.1.2.1.1, we
>|> could not find it in the standard MIB. What is this?
>
>This is not in the standard MIB, it is
>
>internet.private.enterprises.hp.nm.snmp.trap.trapDestinationTable
>.trapDestinationEntry

Yes. I FTPed the HP MIB. (FYI, venera.isi.edu is the anon FTP
host.) Two other guys kindly send me the following mails;

	From: duggan@somnet.sandia.gov (David P Duggan)

>	We have been benchmarking HP Openview here and have run into the
>	same problem.  It occurs when Openview is setting the SNMP trap
>	address on another HP UNIX Workstation.  We put a sniffer on the
>	network to find out the destination machine and decoded the packet
>	to find out all the information.  We told HP about it and never
>	received anything back from them either.


	From: watanabe@elec.nkk.co.jp (Watanabe)

	(He sent me a mail in Japanese. Here is what he indicated.)

	>	internet.4			private
	>	internet.4.1			enterprises
	>	internet.4.1.11			HP
	>	internet.4.1.11.2		nm
	>	internet.4.1.11.2.13		hpsnmp
	>	internet.4.1.11.2.13.1		hptrap
	>	internet.4.1.11.2.13.1.2	trapDestinationTable
	>	internet.4.1.11.2.13.1.2.1	trapDestinationEntry
	>	internet.4.1.11.2.13.1.2.1.1	trapDestination

	(He also explained the mechanism in details.)

>If the Nodemanager finds a HP maschine which it should manage, 
>then it sets the above mentioned object of that maschine to the IP
>address of the Nodemanager.  

They, watanabe@elec.nkk.co.jp and duggan@somnet.sandia.gov (David P Duggan),
also told me this besic mechanism.

>One time we saw that the Nodemanager tried also to set variables on a DEC
>maschine (the system administrator complaint about that, so we unmanaged the
>system).

The serious point is that HP generates the packet burstly. (about
every 0.057 second, I remember.) This results in overloaded
ethernet segment.

>In your case it seems that the Nodemanager tries to set this object in your 
>CISCO box with IP-address 129.60.57.9. This is naturally not possible because
>CISCO does not know about HP private MIBs and therefore a bug, which should be
>reported to HP. Maybe it is fixed in the next release 3.1 which we hope to 
>install next week.

The same problem was reported in US (by Dave) and Japan(We, NTT). 
If you have reported HP about this problem, HP would know that the
problem occured in US, Asia, and Europe, that is, all over the
world. Unfortunately, we have not received any clear answer from
HP. It seems the only way is to configure Open View not to set the
trap vector. 

>BTW, there is no reverse mapping for 129.60.57.9 in the DNS.

Sorry. I modified the IP address randomly, since we can not
make it open. Your DNS resolver is corrent.


Anyway, I understand why it occues. Thank you very much, Michael, 
Watanabe-san, and Dave. 

-Ken

Ken Murakami
NTT Basic Research Labs
Tokyo, Japan
Newsgroups: comp.protocols.snmp