Kernel Warnings snoop_cache_unresolved

Hi Guys

Having a load of these warnings pop up in the logs on my stack and I don't seem to find anything on the forums about it.

Slot-1: exosSnoop: snoop_cache_unresolved:800: Dropping v4 packet with src:x.x.x.x dest:x.x.x.x vlan: **** as number of resolved cache entries reached maximum limit

I take it this has something to do with Multicast? If not any info would be great.

7 replies

Userlevel 3
These messages are generated by the exsnoop kernel module, and it generates this message if 2048 or more packets are queued up to be processed by the snooping module. This message is logged the first time this limit is hit, and thereafter for every 10000 packet that hits this condition.
Is the snooping module enabled by default as I don't have it defined anywhere in my switch configs.

Would it be worth disabling the snooping module?
Userlevel 3
By default, it is enabled.

Please share the below outputs:
a. debug hal show ipv4mc
b. show mcast cache
c. show igmp snooping vlan vlan2018

- Is this a valid destination group address in the network?
- Who is the source IP, any kind of server which generates multicast packets?

Running recommendation C on one of our VLAN's and found an IP that seems to be claiming a huge amount of groups.

I will take a look into the IP and post back.

But it isn't the IP that I see being dropped in my logs. Would this be due to this one host taking up so much of the cache that the other IP's in the group get dropped because the cache limit is hit?

- Josh
I take it this has been marked as resolved?
Userlevel 7
Josh wrote:

I take it this has been marked as resolved?

Hi Josh, yes, it looks like this was marked resolved a few days ago. Has the information in the thread helped?
Josh wrote:

I take it this has been marked as resolved?

It did indeed but I was hoping to get more info from my last reply.