[mrtg] MRTG errors

[Danilo Godec]

On 14.12.2010 10:46, Tobias Oetiker wrote:
> Hi Danilo,
>
> Today Danilo Godec wrote:
>
>>  On 12/14/2010 09:21 AM, Steve Shipway wrote:
>>> Which version of MRTG are you using?  Try upgrading to 2.16.4, and make sure you're not using an older BER.pm or SNMP_session.pm from a previous version.
>> That's the version I'm using. I compiled it myself on OpenSuSE 10.3
>> x86_64, based on some other OpenSuSE SRPM.
>>
>> There were two 'BER.pm' files on the system - one belonging to 'mrtg'
>> (/usr/lib/mrtg2/BER.pm) and the other belonging to 'smokeping'
>> (/usr/lib/perl5/vendor_perl/5.8.8/BER.pm). I removed 'smokeping' as
>> we're not using it, restarted 'mrtg' but it is still the same.
>>
>> As far as I can tell the remaining 'BER.pm' and 'SNMP_session.pm' files
>> are correct and belong to 2.6.4.
> I have asked simon leinen (the author of SNMP_session) about this
> and he sais that the erros does not look anything like he has ever
> seen ... he suggest to use packet capture (wireshark) to identify
> the offending packet.
>
> cheers
> tobi

OK, here it is:

> 2010-12-14 18:54:48 -- SNMP Error:
> Error decoding response PDU:
>   Expected sequence tag 48, got 78
>     %{%i%s%*{%i%i%i%{%@
>       ^
> SNMPv2c_Session (remote host: "10.224.104.1" [10.224.104.1].161)
>                    community: "lancom"
>                   request ID: 1270453324
>                  PDU bufsize: 8000 bytes
>                      timeout: 10s
>                      retries: 10
>                      backoff: 1)
>  at /usr/bin/../lib/mrtg2/SNMP_util.pm line 492

I cought it with 'tcpdump -s0' and opened the resulting file in Wireshark.

I found the 'offending' request ID and compared it to the next one (that
didn't show an error) - but I can't see a difference...

Attached is a .pcap file of these two request ID's...

  Danilo

-------------- next part --------------
A non-text attachment was scrubbed...
Name: snmp2.pcap
Type: application/octet-stream
Size: 335 bytes
Desc: not available
Url : http://lists.oetiker.ch/pipermail/mrtg/attachments/20101214/8d56e83b/attachment.obj