Monitor multicast packet or IP addresses

Folks:
I have just started learning and researching the capabilities of EEM and TCL scripts; however, I am still lost, yet I have a special need for a script that will - monitor packets from a few specific multicast IP addressses, and if the stream stops, send out an email or notify me somehow. Now, I am not sure if that can be done, or if it would be best to create some sort of script.
I just need to be pointed into the right direction, or just to have someone else to brainstorm with.
Thank you
JJ

Fairly certain that packet tracer does not support Secondary IP Addresses on an Interface.
Although packet tracer is great as a learning tool, it has quite a few features which are not included. If you are studying for a CCNA then investing in a cheap second hand 2950 Layer 2 switch is a god idea also.

Similar Messages

Multicast vs Well known address

Couple of questions regarding the multicast communication in a Coherence 3.3 cluster
- What are the downsides of using the well known address scheme compared to multicast for cluster communication. One i could think of was having to explicitly specify all the addresses that need to be part of the cluster. Was wondering if there were any performance related differences?
- What is the amount of multicast traffic that is handled by a member of the Coherence cluster which participates without having any local data stored? Is every message that is sent to the data storage members also sent to the non-data members
Thanks
Ramdas

Hi Ramdas,
What are the downsides of using the well known address scheme compared to multicast for cluster communication. One i could think of was having to explicitly specify all the addresses that need to be part of the cluster. Was wondering if there were any performance related differences?
You don't need to list all addresses, only a subset of servers that is sufficiently large to guarantee that at least one server will be up at all times. Membership data in Coherence is entirely dynamic, so once a client connects to any of those servers, it will make introductions to the rest. For more details, please see:
http://wiki.tangosol.com/display/COH33UG/well-known-addresses
Using well-known-addresses (WKA) completely disables multicast, both for discovery of members and for communication of data. Discovery itself is a fairly inexpensive process. While Coherence relies mostly on point-to-point communication (it automatically selects the most efficient combination of unicast and multicast), there are use cases that require messages to be sent to all nodes (for example, cluster membership information). As you can imagine, if the sending node must send the same data to all other nodes, using unicast is going to be far more expensive that multicast as the cluster size increases (e.g. we've found that in clusters of 1000+ JVMs, the load on the sending member is a significant problem).
Another way of looking at this ... for one-to-all communications (or even one-to-many), with multicast enabled, the switch is effectively acting as a "hardware accelerator" ... if you disable multicast, then you are emulating that behavior in software, which is obviously going to be less efficient (the sender will have the send the same packet to the switch N times (e.g. 1000 in the example above) rather than once).
Fortunately, for a lot of workloads, this isn't as critical, especially for ones that have strong data affinity (e.g. only a few nodes are working with each piece of data).
What is the amount of multicast traffic that is handled by a member of the Coherence cluster which participates without having any local data stored? Is every message that is sent to the data storage members also sent to the non-data members
Aside from membership events (which are global), storage-enabled nodes really only use multicast to notify other nodes when data changes, and this only occurs if multicast is deemed more efficient than unicast (e.g. if there are a lot of subscribers interested in the changed data).
Storage-disabled nodes (clients) will receive (some) multicast traffic for change events. If there isn't good data affinity (e.g. a lot of client-side near caches have overlapping data), then chances are that the storage nodes will be broadcasting data updates rather than sending them individually, and so there will be some multicast packets that need to be ignored (which is relatively inexpensive).
Jon Purdy
Oracle

Lost Multicast Packets on 1 JVM Only

Hi,
I have a cluster of 4 JVM's which is distributed across 2 physical servers. This is running on a windows 32 bit environment.
Machine1: JVM01/JVM02
Machine2: JVM03/JVM04
JVM03 is losting lots of multicast packets, where the others are not. 1600 since 22:30 last night, so in about 12 hours.
I haven't noticed any side effects to the application of this happening, but I can't figure out why if JVM03 is losing them, I don't see them being lost on JVM04 as they are on the same physical hardware.
if it was plugged into a dodgy switch port, then I would expect both JVM's to be affected.
Anyone any ideas?
Pete

Are you running any add-ons that might change the appearance of the page, e.g., add-ons that block ads, Flash, scripts, etc.?
Sometimes you notice glitches in Firefox related to graphics card driver incompatibilities. To rule that out, you could disable hardware graphics acceleration. You usually need to restart Firefox in order for this to take effect, so save all work first (e.g., mail you are composing, online documents you're editing, etc.).
orange Firefox button ''or'' classic Tools menu > Options > Advanced
On the "General" mini-tab, uncheck the box for "Use hardware acceleration when available"
After restarting Firefox, do you notice any difference?

WRVS4400N - eth0: received packet with own address as source address

I am using a WRVS4400N as my primary router for a small office. I get the following message repeated over and over in my logs. This seems to happen for 2 or 3 days and then it will go away for about a week and then come back. Does anyone know what is causing this? The best I can tell I don't have any IP conflicts on the network and most of the time the network has very little traffic other than 2 or 3 computers surfing the web.
Jan 3 16:48:09 - eth0: received packet with own address as source address
Jan 3 16:48:09 - eth0: received packet with own address as source address
Jan 3 16:48:15 - eth0: received packet with own address as source address
Jan 3 16:48:27 - eth0: received packet with own address as source address
Jan 3 16:48:51 - eth0: received packet with own address as source address

any news on this issue?
I am getting more and more messages (20+/day) - hundreds this month.
Now Coming every 10 minutes - HELP
eth0: received packet with own address as source address
Done everything, now waiting for input from Cisco.
Please, anyone as Cisco got any answers?
1:38 AM [email protected] WRVS4400N Security Log [6B:C6:FD]
12:36 AM [email protected] WRVS4400N Security Log [6B:C6:FD]
2:38 AM [email protected] WRVS4400N Security Log [6B:C6:FD]
3:38 AM [email protected] WRVS4400N Security Log [6B:C6:FD]
4:38 AM [email protected] WRVS4400N Security Log [6B:C6:FD]
5:38 AM [email protected] WRVS4400N Security Log [6B:C6:FD]
6:38 AM [email protected] WRVS4400N Security Log [6B:C6:FD]
7:38 AM [email protected] WRVS4400N Security Log [6B:C6:FD]
8:38 AM [email protected] WRVS4400N Security Log [6B:C6:FD]

System.log fills up with bad packets errors (Multicast packet - CRC error)

Hello,
I've been trying to Google my problem but found no answers; hopefully someone can help me?
Whenever I'm online, my System.logs fills up (every second, and sometimes, multiple times each second) with the following message :
19/12/07 12:51:01 PM kernel AppleYukon2 - bad packet received. length: 60, packet status bits: Multicast packet, CRC error
19/12/07 12:51:01 PM kernel AppleYukon2 - bad packet received. length: 60, packet status bits: Multicast packet, CRC error
My DSL modem is connect directly into my iMac. It's a Speedstream 5360). I never have any problems connecting to the Internet and the speed I get is fine. When I configured my Network settings, I only added my PPPoE Service name username and âssword - everything else was automatically added (Ethernet configuration).
Is there anything I should change in the Advanced Settings?
The System.log causes me problem because it often causes the application Console to crash when I try to view it.

I should add that this problem didn't exist when I was using Tiger.
Also, when I called Apple Tech Support, I was simply told "just don't play with the Console".

Multicast packets on trunks

I have two switches connected via ISL trunks. Multicast packets can't get from one switch to the other even though the source and destination are on the same VLAN and is trunked. Shouldn't the switch just pass it on like other layer 2 frames?

The difference is that EIGRP speakers have signaled their intent to listen to multicast traffic. So IGMP Snooping functionality relays that multicast traffic to them.
See
http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008059a9df.shtml
for several solutions to this issue.
Yet another reason to not like NLB....
Michael

Drop multicast packets at layer 2 or 3 ??

In one of packet tracer activity in the book "network fundamentals", it said that devices that are not configured to receive multicast traffic will drop packet at Layer 3. However, in the book "routing protocols and concepts", it said differently. It said " In addition, multicasting updates require less processing by devices that are not RIP enabled. Under RIPv2, any device that is not configured for RIP will discard the frame at the data link layer " (it means Layer 2).
Can anyone help me to explain this? Thank you very much.

Hi,
I would keep the TOR switches (3000) as layer-2 only. Create the SVIs for all your vlans on the 9396 and do the inter-vlan there. This keep your design pretty simple.
HTH

Is it possible for JMF to monitor RTCP packet from another application?

Hello Everybody.
I'm developing an application that will gather statistics in Live Streaming transmissions.
For that, I'll get bandwidth use and RTCP packets so I can put in a graphic packet loss and other relevant data that are put into RTCP Packet.
I wanted to know if it's possible for JMF to monitor an existing stream (not created by the Java program), so I can use in my application (Java-based).
Thanks a lot for the attention.
Cheers,
Bentow.

Bentow wrote:
And, what about a class that it have in the com.sun.media.rtp package? RTCPPacket?
It doesn't have any docs about it. The problem is the the parent type is Packet, but different than the one, that in this case is used by the JPCAP. :(Like I said, JMF has the code in there to parse RTCP packets. But they aren't a peice of JMF you're supposed to be using. You'll just have to hack and slash to try to get something working with it. ;-)

SPAN / Monitor Ports - packet switched on Line Card

Hi Forum,
I got a quick SPAN / Monitor question. I need to create a monitor session where the source is a VLAN. The question is if the L2 source and destination are switched internally on a different linecard to the the monitor destination, then does the SPAN port know about it.
I was wondering as in theory, the packet does not go on the backplane, then how does the switch monitor session know about it ??
Graham

Hi,
In the Catalyst 6500 Series, it is important to note that egress SPAN is done on the supervisor. This allows all traffic subject to egress SPAN to be sent across the fabric to the supervisor and then to the SPAN destination port, which can use significant system resources and affect user traffic. Ingress SPAN will be done on ingress modules so SPAN performance would be the sum of all participating replication engines. The performance of the SPAN feature depends on the packet size and the type of ASIC available in the replication engine.
See this link below that contains details about the SPAN on different platforms.
http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml#topic6
Regards,

UCCX7 - Monitoring/Recording packet flow behavior

Hi,
I have single UCCX7 box which all services include monitoring/recording started and want to understand the packet flow behavior with CAD application.
1. Monitoring, Desktop capture mode
1) in CSD, select CAD and click "start Monitoring"
2) copy the RTP packets from agent IP Phone to CAD via IP Phone "SPAN port" feature
3) CAD sends the RTP packets to CSD and CSD able to hear the agent IP Phone conversation via CSD's sound card
->please advise whether the steps are correct!!
2. Monitoring, Server capture mode
1) how start the monitoring?
2) where the actual file stores? which directory in UCCX box?
(**I know UCCX's 2nd NIC which configured to VOIP monitor receiving RTP packets via switch's SPAN port but don't know how the monitoring start and where the file stored)
3. Recording, Desktop capture mode
1) click "start Recording" in CSD or CAD (CAD=add button from work flow user interface)
2) copy the RTP packets from agent IP Phone to CAD via IP Phone "SPAN port" feature
3) where the actual file stores? CAD box or CSD box?
(**I know CSD can retrieve the recorded file and have an option to save but don't know where the recorded file retrieved)
4. Recording, Server capture mode
1) how start the recording?
2) where the actual file stores? which directory in UCCX box?
Advise please!!

Hi,
1. This is correct. CSD sends the startMonitoring message to CAD directly. CAD sends RTP packets to CSD directly and CSD plays them.
2. CSD sends startMonitoring to UCCX server. Since the agent phone is spanned to the UCCX server's VOIP Mon NIC, the server then traps the packets and sends them back to the CSD which plays them.
3. Recorded files are stored in TO and FROM .raw format in C:\Program Files\Cisco\Desktop_Audio on the UCCX server
4. Same as above.
The best thing to do, and how most of TAC troubleshoots is to use the CSD and CAD debugs set to TRACE and also Wireshark on the CAD, CSD and UCCX server all at the same time.

Report to Monitor the change of delivery address on the delivery document

Is there a report that can show me when a user had changed the delivery address in a sales document or delivery document. The ship to # would stay the same but the address can be changed within the sales document which does not effect Master Data records.
We are trying to moitor this to find where users have modified the address when shipping a delivery.
Thanks

Grant,
I was unable to find a solution to your problem. I think it is unlikely that this change
when a user had changed the delivery address
is explicitly recorded by SAP. In the systems I looked at today, address changes in Sales docs are not among those that are automatically recorded.
You can, however, look in table VBPA. If an address has been entered manually (vs the normal automatic determination via customer master tables), then VBPA-ADRA is changed to 'E'. Unfortunately, I can't find any place where this event is time-stamped, or the user responsible is recorded. You might be able to intuit the user using other means.
Regards,
DB49

Multicast packets per second

Are there any pointers to multicast performance numbers on a cisco switch?

Hi,
For Layer 2 platforms, IGMP snooping is implemented in hardware, so forwarding performance is only limited by the overall performance of the switch. Unconstrained multicast are forwarded as broadcasts, so the same restriction applies.
2950 specs:
http://www.cisco.com/en/US/products/hw/switches/ps628/products_data_sheet09186a00801cfb64.html
Couldn't find any specs for the 3500Xl switches, as they are well past end of sale, but they'll operate the same, with the exception that they use CGMP rather than IGMP snooping.
For the 4000, i'll need to know which supervisor, and if you are talking about layer 2 multicast or multicast routing.
HTH,
Bobby
*Please rate helpful posts.

Monitor the changes of Ship to address in Sales Order

Hi,
My client has an requirment which they would like to monitor whether the ship-to-address has been modified after the order were save.
e.g.
Sold-to 12345
Ship-to 12356
SAVE the order
After the order are sale and sometime later, the user went in VA02 and update the ship-to-address to 23456
now
sold-to 12345
ship-to 23456
It there anyway we can have a report to check if the ship-to has been changes?
thanks,
Rebella

Hello Rebella,
The best option of monitering the changes incurred fro the Ship-to-Party details of a SALES ORDER are as follows:
If you are interested to pick up the information of changes values of Ship-To-Party from a Sales Order then i think you can use the table VBPA. This table will contain the updated value of Ship-To-Party partner function of a Sales Order.
Second option would be to use a program which actually run when you open a Sales Order in VA03 --> Environment --> Changes. You can develop a t-code which shall call this program.
You can also use the T-code AUT10 for tracking changes for a Sales Order.
Hope these infotmation helps you in resolving your issue and please don't forget to mark your thread as closed.
Regards,
Sarthak

SG300 inter-VLAN routing and MAC address changes in incoming packets

Hello
I have SG300-20 working in Layer3 mode
VLAN1 is not used
Internet gateway is in VLAN211
Clients are in other VLANs
Switch is default gateway for clients and itself has internet gateway as default route.
MAC address of switch is XX:XX:XX:XX:XX:63
When client sends trafic to Internet destination MAC address in outgoing packets is XX:XX:XX:XX:XX:63
But in incoming packets source MAC address is XX:XX:XX:XX:XX:69
Why does it change? And how can I setup switch to use only XX:XX:XX:XX:XX:63 MAC address?

Hi Robert,
I'd like to pick up this old thread because we have a huge problem with the behavior of the SG300 router/switch regarding the "spoofed" MAC source addresses. We have connected this switch to another router which has some special routing capabilities. It routes certain IP packets directly to MAC addresses which it learned from snooping on special traffic.
When connected to a SG300 router with an Ethernet base address of XX:XX:XX:XX:XX:48 we receive packets with Ethernet source addresses like e. g. XX:XX:XX:XX:XX:49 or XX:XX:XX:XX:XX:4D (depending on which hardware port they came from). Our special router "learns" these MAC addresses and tries to send associated outgoing packets directly to these addresses using e. g. XX:XX:XX:XX:XX:49 as the MAC destination address.
Our problem is that the SG300 does not forward the packet if the MAC destination address is not equal to the switch's Ethernet base address (XX:XX:XX:XX:XX:48 in our case). This renders the SG300 series useless for our systems.
Is there new firmware available which fixes this problem for us? We don't care which MAC source address the SG300 uses in incoming packets we receive, but we expect that the SG300 handles packets correctly for outgoing packets we send with this MAC address as the destination address.
Thanks,
Chris

Multicast IP address keep changing on music on hold

Hi
I am trying to set up multicast for music on hold on the cucm 9.
on the cucm, I enable multicast audio sources on MOH server, using base IP 239.1.1.1, and set increment multicast on " ip address"
however the multicast IP address keep changing, sometimes its 239.1.1.1, then after a while it suddenly change to 239.1.1.2 etc..
here is the config on our srst router ( which specify the multicast ip is 239.1.1.1):
is there any way that the multicast ip do not keep changing as its affecting the MOH at the moment.
" config for MOH"
telephony-service
video
srst mode auto-provision none
srst dn template 1
srst dn line-mode dual
max-ephones 265
max-dn 600
ip source-address 10.190.0.1 port 2000
timeouts interdigit 5
system message "GlobalDial Unavailable"
cnf-file location flash:
time-zone 48
date-format dd-mm-yy
voicemail 080758831#
max-conferences 8 gain -6
moh "xmas_jazz.wav"
multicast moh 239.1.1.1 port 16384 route 192.168.1.1
transfer-system full-consult
transfer-pattern 0.T
secondary-dialtone 0
create cnf-files version-stamp 7960 Nov 27 2013 18:23:59
I was thinking to put a few more multicast IP,. but it only allow you to put one ( while the cucm set the IP address as increment)
OC-MHO-VG-SRST(config)#telephony-service
OC-MHO-VG-SRST(config-telephony)#multi
OC-MHO-VG-SRST(config-telephony)#multicast ?
moh Set IP multicast address for use with music-on-hold from flash
OC-MHO-VG-SRST(config-telephony)#multicast moh ?
A.B.C.D Define music-on-hold IP multicast address from flash
OC-MHO-VG-SRST(config-telephony)#multicast moh 239.1.1.2 ?
port Define media port for multicast moh
OC-MHO-VG-SRST(config-telephony)#multicast moh 239.1.1.2

Hi Rachel,
If the Increment Multicast on radio button is set to IP address, each MOH audio source and codec combination is multicast to different IP addresses but uses the same port number. If it is set to Port Number, each MOH audio source and codec combination is multicast to the same IP address but uses different destination port numbers.
http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cusrst/admin/sccp_sip_srst/configuration/guide/SCCP_and_SIP_SRST_Admin_Guide/srst_appendix_b_.html#50022
HTH
Manish

Monitor multicast packet or IP addresses

Similar Messages

Maybe you are looking for