x440-24p - IPMC Group Table Entries - full
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎12-30-2016 08:55 AM
Hello,
I have problem that apears here kinda often, but not a single one that matches mine.
In logs of X440-24p running on 16.1.3.6 i see from some time:
IPv4 multicast entry not added. Hardware Group Table full.
I have only few vlans on it, and it works as AP access switch. Nothing special.
Some commands that I think might be interesting.
debug hal show ipv4Mc
Total IPMC Cache Entries : 2(IPv4 : 2, IPv6 :0)
Total IPMC Caches with No Group Index : 1(IPv4 : 1, IPv6 :0)
L2 Mode Caches with No Group Index : 0(IPv4 : 0, IPv6 :0)
L3 Mode Caches with No Group Index : 1(IPv4 : 1, IPv6 :0)
IPMC Group Table Entries In-use : 64
IPMC Group Table Entries Max : 64
L2MC Group Table Entries In-use : 0
L2MC Group Table Entries Max : 0
IPMC Forwarding Mode : 1
vrId 2 G=239.255.255.250 S=255.255.255.255 Vid 394 : (HW IPMC -1 l3hash 0 hit 0)
vrId 2 G=239.255.255.250 S=10.160.35.30 Vid 394 : (HW IPMC -1 l3hash 0 hit 0)
-> Vid 394
-> 1
show iproute reserved-entries statistics
|-----In HW Route Table-----| |-------In HW L3 Hash Table------|
# Used Routes # IPv4 Hosts IPv4 IPv4 IPv6 IPv4 IPv6
Slot Type IPv4 IPv6 Local Remote Local Rem. Local MCast MCast
---- --------------- ------- ------ ------ ------ ----- ----- ----- ------ ------
1 X440-24p 0 0 0 0 0 0 0 0 0
show forwarding configuration
L2 and L3 Forwarding table hash algorithm:
Configured hash algorithm: crc32
Current hash algorithm: crc32
L3 Dual-Hash configuration:
Configured setting: on
Current setting: on
Dual-Hash Recursion Level: 3
Hash criteria for IP unicast traffic for L2 load sharing and ECMP route sharing
Sharing criteria: L3_L4
IP multicast:
Group Table Compression: on
Local Network Forwarding: slow-path
Lookup-Key: (*,GroupIP,VlanId)
Switch Settings:
Switching mode: store-and-forward
L2 Protocol:
Fast convergence: on
Fabric Flow Control:
Fabric Flow Control: auto
Any ideas what might fill the IPMC Group Table to the maximum? Or its not the issue?
I have problem that apears here kinda often, but not a single one that matches mine.
In logs of X440-24p running on 16.1.3.6 i see from some time:
I have only few vlans on it, and it works as AP access switch. Nothing special.
Some commands that I think might be interesting.
debug hal show ipv4Mc
Total IPMC Cache Entries : 2(IPv4 : 2, IPv6 :0)
Total IPMC Caches with No Group Index : 1(IPv4 : 1, IPv6 :0)
L2 Mode Caches with No Group Index : 0(IPv4 : 0, IPv6 :0)
L3 Mode Caches with No Group Index : 1(IPv4 : 1, IPv6 :0)
IPMC Group Table Entries In-use : 64
IPMC Group Table Entries Max : 64
L2MC Group Table Entries In-use : 0
L2MC Group Table Entries Max : 0
IPMC Forwarding Mode : 1
vrId 2 G=239.255.255.250 S=255.255.255.255 Vid 394 : (HW IPMC -1 l3hash 0 hit 0)
vrId 2 G=239.255.255.250 S=10.160.35.30 Vid 394 : (HW IPMC -1 l3hash 0 hit 0)
-> Vid 394
-> 1
show iproute reserved-entries statistics
|-----In HW Route Table-----| |-------In HW L3 Hash Table------|
# Used Routes # IPv4 Hosts IPv4 IPv4 IPv6 IPv4 IPv6
Slot Type IPv4 IPv6 Local Remote Local Rem. Local MCast MCast
---- --------------- ------- ------ ------ ------ ----- ----- ----- ------ ------
1 X440-24p 0 0 0 0 0 0 0 0 0
show forwarding configuration
L2 and L3 Forwarding table hash algorithm:
Configured hash algorithm: crc32
Current hash algorithm: crc32
L3 Dual-Hash configuration:
Configured setting: on
Current setting: on
Dual-Hash Recursion Level: 3
Hash criteria for IP unicast traffic for L2 load sharing and ECMP route sharing
Sharing criteria: L3_L4
IP multicast:
Group Table Compression: on
Local Network Forwarding: slow-path
Lookup-Key: (*,GroupIP,VlanId)
Switch Settings:
Switching mode: store-and-forward
L2 Protocol:
Fast convergence: on
Fabric Flow Control:
Fabric Flow Control: auto
Any ideas what might fill the IPMC Group Table to the maximum? Or its not the issue?
14 REPLIES 14
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎12-30-2016 09:22 AM
Michał
if you don't need mcast traffic on specific port, you can block it at ingress:
configure ports 1 rate-limit flood multicast 0
--
Jarek
if you don't need mcast traffic on specific port, you can block it at ingress:
configure ports 1 rate-limit flood multicast 0
--
Jarek
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎12-30-2016 09:22 AM
I know that. Its not working very good tho.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎12-30-2016 09:21 AM
Changed deny-cpu to deny, next refresh policy and next step was clear ipmc fdb group 239.255.255.250 and switch rebooted itself.
At the moment its running on 16.2.1.6 (it was installed previously but not rebooted)
And shows
debug hal show ipv4Mc
Total IPMC Cache Entries : 8(IPv4 : 8, IPv6 :0)
Total IPMC Caches with No Group Index : 0(IPv4 : 0, IPv6 :0)
L2 Mode Caches with No Group Index : 0(IPv4 : 0, IPv6 :0)
L3 Mode Caches with No Group Index : 0(IPv4 : 0, IPv6 :0)
IPMC Group Table Entries In-use : 4
IPMC Group Table Entries Max : 5
L2MC Group Table Entries In-use : 0
L2MC Group Table Entries Max : 0
IPMC Forwarding Mode : 1
vrId 2 G=239.2.0.252 S=255.255.255.255 Vid 391 : (HW IPMC 3 l3hash 0 hit 0)
vrId 2 G=239.2.0.252 S=xxx.xxx.xxx.xxx (public IP) Vid 391 : (HW IPMC -1 l3hash 0 hit 0)
-> Vid 391
-> 1
vrId 2 G=239.255.255.250 S=255.255.255.255 Vid 391 : (HW IPMC 3 l3hash 0 hit 0)
vrId 2 G=239.255.255.250 S=255.255.255.255 Vid 394 : (HW IPMC 1 l3hash 0 hit 0)
vrId 2 G=239.255.255.250 S=255.255.255.255 Vid 362 : (HW IPMC 2 l3hash 0 hit 0)
vrId 2 G=239.255.255.250 S=xxx.xxx.xxx.xxx (public IP) Vid 362 : (HW IPMC -1 l3hash 0 hit 0)
-> Vid 362
-> 1
vrId 2 G=239.255.255.250 S=xxx.xxx.xxx.xxx (public IP) Vid 391 : (HW IPMC -1 l3hash 0 hit 0)
-> Vid 391
-> 1
vrId 2 G=239.255.255.250 S=10.160.38.224 Vid 394 : (HW IPMC -1 l3hash 0 hit 0)
-> Vid 394
-> 1
sh access-list counter
Policy Name Vlan Name Port Direction
Counter Name Packet Count Byte Count
==================================================================
block-multicast * * ingress
LLMNR-deny 0
mDNS-deny 30
sh conf | i block
configure access-list block-multicast any ingress
Gonna do some more testing.
At the moment its running on 16.2.1.6 (it was installed previously but not rebooted)
And shows
debug hal show ipv4Mc
Total IPMC Cache Entries : 8(IPv4 : 8, IPv6 :0)
Total IPMC Caches with No Group Index : 0(IPv4 : 0, IPv6 :0)
L2 Mode Caches with No Group Index : 0(IPv4 : 0, IPv6 :0)
L3 Mode Caches with No Group Index : 0(IPv4 : 0, IPv6 :0)
IPMC Group Table Entries In-use : 4
IPMC Group Table Entries Max : 5
L2MC Group Table Entries In-use : 0
L2MC Group Table Entries Max : 0
IPMC Forwarding Mode : 1
vrId 2 G=239.2.0.252 S=255.255.255.255 Vid 391 : (HW IPMC 3 l3hash 0 hit 0)
vrId 2 G=239.2.0.252 S=xxx.xxx.xxx.xxx (public IP) Vid 391 : (HW IPMC -1 l3hash 0 hit 0)
-> Vid 391
-> 1
vrId 2 G=239.255.255.250 S=255.255.255.255 Vid 391 : (HW IPMC 3 l3hash 0 hit 0)
vrId 2 G=239.255.255.250 S=255.255.255.255 Vid 394 : (HW IPMC 1 l3hash 0 hit 0)
vrId 2 G=239.255.255.250 S=255.255.255.255 Vid 362 : (HW IPMC 2 l3hash 0 hit 0)
vrId 2 G=239.255.255.250 S=xxx.xxx.xxx.xxx (public IP) Vid 362 : (HW IPMC -1 l3hash 0 hit 0)
-> Vid 362
-> 1
vrId 2 G=239.255.255.250 S=xxx.xxx.xxx.xxx (public IP) Vid 391 : (HW IPMC -1 l3hash 0 hit 0)
-> Vid 391
-> 1
vrId 2 G=239.255.255.250 S=10.160.38.224 Vid 394 : (HW IPMC -1 l3hash 0 hit 0)
-> Vid 394
-> 1
sh access-list counter
Policy Name Vlan Name Port Direction
Counter Name Packet Count Byte Count
==================================================================
block-multicast * * ingress
LLMNR-deny 0
mDNS-deny 30
sh conf | i block
configure access-list block-multicast any ingress
Gonna do some more testing.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎12-30-2016 09:07 AM
I have ACL like that on that switch. But action is deny-cpu not simple deny. Will try to block it.
entry deny_LLMNR {
if match all {
ethernet-destination-address 01:00:5e:00:00:fc;
} then {
deny-cpu;
count LLMNR-deny;
}
}
entry deny_mDNS {
if match all {
ethernet-destination-address 01:00:5e:00:00:fb;
} then {
deny-cpu;
count mDNS-deny;
}
}
entry deny_LLMNR {
if match all {
ethernet-destination-address 01:00:5e:00:00:fc;
} then {
deny-cpu;
count LLMNR-deny;
}
}
entry deny_mDNS {
if match all {
ethernet-destination-address 01:00:5e:00:00:fb;
} then {
deny-cpu;
count mDNS-deny;
}
}
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎12-30-2016 09:00 AM
Probably this multicast address, 239.255.255.250.
https://gtacknowledge.extremenetworks.com/articles/Q_A/What-is-the-239-255-255-250-traffic-I-see-man...
The X440 does not have much space for multicast entries, if you dont need this IP multicast to be forwarded you can block it using an ACL.
https://gtacknowledge.extremenetworks.com/articles/Q_A/What-is-the-239-255-255-250-traffic-I-see-man...
The X440 does not have much space for multicast entries, if you dont need this IP multicast to be forwarded you can block it using an ACL.
