NTOP Traffic Process

If activated, how is NTOP traffic processed?
Is the NTOP traffic correlated and summarized in the ON100, and results forwarded to OnPlus?
... or is it forwarded to OnPlus in raw form, where such processing is done?
The concern is whether (in case #2) there could be an impact on WAN bandwidth because such traffic would seem to be transmitted twice, once as normal traffic and a second time via the SSL connection to OnPlus.
TIA

Hi Curt,
My apologies for the delay in response. The NTOP application is installed locally on the ON100 and all traffic is capture and correlated on the ON100 itself, this information is not processed in the cloud. The cloud provides the tunnel into the ON100 to access the NTOP environment.
You can also locally access NTOP on the ON100 by navigating to the ON100 IP with port 3000.
Thanks,
The OnPlus Team

Similar Messages

Load Balancing, Tomcat, and SharePoint

I'm a new BusinessObjects customer and am working on getting all of the hardware in place for a new install. The initial plan is to have two BOE servers, and two tomcat virtual servers, with a hardware based load balancer (F5 BIG-IP Switch: Local Traffic Manager 1600 4GB, possibly) in front of the tomcat servers to handle the load balancing.
But, I'm starting to think that it would be a good idea for us to integrate directly in to our SharePoint portal using the SAP SharePoint Integration option.
So, here's my question. If we do that, then our users will get to their BusinessObjects information via SharePoint. So, SharePoint and IIS will be the web server. Will we still have a need for the Tomcat servers? Will SharePoint point to the load balancer, then to Tomcat, and finally to the BOE server, or will it go right to the BOE server, thus negating the need for the tomcat servers altogether, and also even negating the need for the load balancer? If so, can the BOE app servers themselves still be load balanced?
Hopefully this all makes sense - like I said, we're a new customer, so I don't fully understand all of what the servers are doing. I've spent several days searching the forums & the web & reading documentation and haven't come up with an answer yet, so I'm reaching out to you all & hoping somebody can clear it up for me. Thanks!!

Thank you for your input, Denis, this does help explain things. Also, thanks for pointing me to that Windows Patterns document. I hadn't seen that one - since we're starting out on 4.0, I've only been looking at documents under the 4.0 folders...
It sounds like we may want to utilize this same load balancer to balance the SharePoint traffic as well, while we're at it. Right now our SharePoint server is clustered using Microsoft Clustering, but not load balanced in any way. Or maybe we just post a link from within SharePoint to the regular old BI LaunchPad and call it a day!
So, if I understand correctly, if we utilize SharePoint, any traffic/processing that the Tomcat server would have handled would now be handled by the SharePoint server, which could potentially be significant. The actual processing of the reports, though, will still get handled by the BOE Cluster, which takes care of its own load balancing, so we'll be fine. Really the only thing the hardware load balancer does is allow the presentation layer to be load balanced - the layers beyond that get load balanced automatically via CMS. Is that all somewhat valid? In the patterns doc, there's Application Servers separate from the BOE Servers. We were just going to have two BOE servers and two Web servers. Where do the application servers fall in, and are they load balanced using the hardware piece?
If we were just concerned about High Availability, it seems like maybe we could more easily use Windows Clustering on those Tomcat servers, and avoid the hardware component altogether. Do the Web servers really get hammered that hard that we need them load balanced? It seems like the BOE servers are the ones doing the heavy resource intensive tasks and we get them load balanced without the hardware anyway, so maybe load balancing the web servers is overkill..... I'm sure a lot of this is tough to answer, I'm just trying to get a feel for it. I want us to have our best performance & be somewhat future-proofed, but don't want to buy things that I don't need to! We're probably looking at a small, 10-20 concurrent user setup for starters, and out to say 200 concurrent max once it's fully rolled out...
Thanks again!!

Forms server architecture advice needed

Hi
We are using Forms & Reports Standalone 10.1.2.3.0. I am trying to get confirmation on two areas: how network traffic flows between client and Forms Server, and if traffic between the client and engine is encrypted.
Network Traffic
==========
Are the steps below the correct sequence of steps, particularly the last two steps?
. user enters the appropriate URL into a browser
. web server serves page containing applet tag (the applets render the forms screens on the client)
. Browser requests applet if not already on client
. Web server downloads applet to client
. Applet on client contacts Forms Listener on server (using socket specified).
. Forms listener starts a java runtime process on the server and hands off communication to it.
. All further communication (as the user interacts with the form) is directly between applet on client and runtime process on server.
Encryption
=========
Once communication between the client and the runtime applet is a direct relationship, is this traffic encrypted. I have seen a white paper from 2006 "An overview of Oracle Forms Server Architecture" which states it is, but this paper is 8 years old and I cannot find anything more upto date for 10gRel2.
Any help would be appreciated.
Regards
Andy

Oracle's reply to my questions were:
Network Traffic
=========
Your understanding for the forms network traffic process is almost correct, except for step (7), where further communication between the applet and the runtime process is done through the Forms Listener Servlet, i.e. not a direct communications as was the case with sockets.
But I believe this is not a network security issue, as both the Forms Listener Servlet and runtime process should reside on the same server machine.
Encryption
=======
If security is an issue for you, Forms Development do not promote the 40 bit encryption as a secure solution. It dates back to a time when security did not have such a high profile, and most applications were run over the intranet.
In that case, I would recommend using SSL.
Regards
Andy

WAAS using WCCP from 2 6509's?

I am preparing to install a WAE in the datacenter using WCCP for redirection of traffic to 1 of my networks on a point-to-multipoint frame relay network. Where things get foggy is the WCCP server install on my "router" which is actually 2 6509's which are used to route different vlans for both redundancy and load-balancing in the Datacenter. Is it possible/advisable to set both up with WCCP to redirect to the WAE? Could this cause any unforeseen issues?
I'm also wondering about traffic that is destined for other networks on that point-to-multipoint frame relay connection that my remote site is on which will have the other WAE. Will it be easy to specify which traffic to redirect to the WAE (that which is destined for that one remote site) or will this also cause issues?
Thanks in advance!

Karen,
With WCCP, you can have multiple WAEs (theoretically up to 32) and multiple routers (again up to 32) in the service group. So in your case, both routers can be registered to the same WAE(s). You can limit traffic via a redirect-list, which is an ACL (only accept traffic to/from your remote site).
WCCP is configured on the interfaces for the service groups you are interested in. For WAAS, you use services 61 and 62 in opposite directions to perform load balancing appropriately.
A hint on your wccp on the 6500. Always configure redirect-in on the interfaces, L2-redirect and mask-assign to keep the traffic processed in hardware.
Here is a link on configuring WCCP for WAAS (which I assume you are deploying).
Hope that helps,
Dan

ACLs on WLC

hi Experts,
just a question regarding ACL configuration on the WLC. I am a bit confused on when to use CPU ACL and when should we apply the ACL on an interface?
it seems CPU ACL is used to filter traffic processed by CPU, so normally used to prevent access to WLC through GUI/ssh/telnet.
and if we apply ACL on an interface, then this is mainly used to filter data traffic.
can you please help to clarify the difference between the two and what would be the best practice to use them?
appreciate for any comments.
Andy

If you do configure acl’s on the WLC, I would not create a cpu acl, because you might end up locking yourself of the wlc. You can create acl’s for the interface to deny or allow traffic from that interface or even do a pre-auth acl if you wanted to. I only use acl’s on the wlc if I have to (webauth) or else I would use acl on the layer 3 switch instead.

Cascading Security Contexts

Hi..
Anybody knows how to configure Cascading Security Contexts in Cisco ASA? How works?
Any step by step configure?
Thanks...

Hello Luis,
That document is rather sparse when it comes to detailed information on Cascading contexts. Are there any documents that go into more details?
In particular I am looking for packet processing information. If you have multiple contexts that have their outside interfaces connected to a "Gateway Context" is Inter-Context traffic processed entirely by the ASASM and does not hit the switch?
Im comparing this to a standard configuration in which multiple contexts would have their Outside interfaces connected to the switches MSFC. In that configuration I would think that the switch would need to process the packets as they egress the outside interface of one context and ingress the outside interface of another.
I would see how in either scenario the switch would process the Layer-2 switching. In the 1st example I would not expect the switch to have to process the Layer-3 traffic as its routing between 3 different contexts on the same ASASM and not having to route down to the MSFC.
Thank you.
Edit:
Just thought of something else I had on my mind. Would it be possible to run EIGRP between cascading contexts when running ASA Version 9.0(1)

Wrong messages about invalid certifcates - "This connection is untrusted"

Introduced with appr. FF 11/12/13 I experienced very often, nearly reproducible, "This connection is untrusted" messages when trying to connect to 100% trustworthy sites with 100% trustworthy and valid certficates. Sometimes on initial connect, sometimes within a https session. Very often reproducible:
- Connect to https site - fine
- connect to whatever http (NOT https) site in another window/tab: fine
- switch to first tab window/tab and navigate to different page: "connection is untrusted"
When message appears on first connect: Close FF, restart FF. Maybe several times.
As I've checked my machine with several malware etc. tools available to be sure not to have any trojans or similar sh... on my machine, also traced with sysinternal.com tools the TCP/IP traffic, process activtity etc., I'm sure that my machine is clean.
As now, FF 14.0.1, this DOES NOT happen again, have there been any known issues about this behaviour?

Which security software (firewall, anti-virus) do you have?
Some security software intercept secure connections and send their own certificate.
Some examples are ESET and Bitdefender.
*ESET setup -> advanced setup -> extend web and email tree -> SSL
*SSL protocol: Do not scan SSL protocol
Disable Scan SSL in the BitDefender settings.
*BitDefender -> Privacy settings -> disable Scan SSL

Traffic light in collective delivering processing

Hi Folks,
I was wondering while doing collective delivery processing against STO..i am able to process delivery inspite of red traffic light when it should be only under yellow light ...How is that possible ? also would like to know how and when red and yellow light appears..
Look forward to hear from you soon..
Thanks and Regards
Rahul

Hi Rahul,
Red light indicates error from where you cannot proceed further.
Yellow light indicates warning, but you can still proceed further at that level.......which may affect at further level.
Green light indicates ok
In your case, check if you can run the whole cycle successfully. if the system lets you pass through the red indicator........it could be system bug.
Regards
Sai

Process traffic monitoring...

Hello All,
I am writing an application for counting number of bytes sent/received by each process over the network. I have found the following tools doing the same task which are-
ProcessExplorer (Sysinternals) ---source code not available
TCPView (Sysinternals) ---source code not available
I tried to search the technique that these functions are using and I found that these are using Event Tracing but I could not write my own program using it.
I would really appreciate if you'd answer the following questions in a way I could understand.
1) How to write program like TCPView for getting traffic information for each process
Language - C/C++
platform- Windows

Thanks Paul for your reply,
Using Win API I have written a program that counts number of bytes sent and received by a process.
To calculate Total number of bytes sent/received bytes by a particular process I have taken a counter which is incremented by transfer size(bytes) each time an event occur and finally I get total bytes sent/received.
I am doing the above calculation in the event callback function which is called each time an event is generated.
But I am facing a problem,I tried to send a big file (approx 100MB) through ftp (file transfer protocol) using winscp utility. At the same time I started TCPVew (Sysinternals) and tried to match the result with my application but I found that bytes
sent and received in TCPView is far more than shown by my application.
I think lots of events got lost in my case.
Please tell me what should I do to equip my application so that even a single event is not lost.
Eagerly waiting for your reply..
Thanks
Raghav

Issue about Automated Process Traffic light status

Hi experts,
In our system(BW 3.1), we found sth interesting. The automated data load finished. But when monitoring the status using T-code RSMO, we found some traffic lights are set to red. The reason for red light is timeout.
I figure: There is sth such as 'finish flag' for the traffic light to turn green, but after the dataload finished, the system didn't get it, so it waited till timeout.
I am not sure of it, and can't find any material about it.
Could anyone help me to explain this phenomenon?
many thanks and best regards,
Zehua

Hi,
Data will always be loaded into the cube irrespective of the traffic light status. Whether the load is in the cube or no, depends on the processing stage at which it has failed. You can see this in the monitor.
Goto the details tab. There are multiple headings like Extraction, Transfer, Processing.
Extraction and transfer are related to how the data is brought into the system. Processing is when the data is actually loaded somewhere either PSA or infoprovider or both depending on your processing type set in the infopackage.
In your process chain, various processes are triggered depending on the type of link maintained in between two processes. These are of 3 types 1) Successful 2) Failed 3) Always .
If the 1st one is selected, then the chain will move forward, if the previous step is green, 2nd case, if it is red and the 3rd one always.
Regarding why the status are not being updated, check where the load is yellow. If it is transfer, then possiblities are that IDOcs are'nt being set properly, if it is a custom datasource with function module check whether the NO_MORE_DATA exception is being raised properly.
Also check whether there are any short dumps in the source system or the BW system
Hope this helps,
Regards,
Regards.

Several 100MB of traffic on a FIN_WAIT_2 port - process long gone

I have 100s of Megabytes of traffic for a loooooooong time (10-20 minutes) after the process has gone on the port that used to belong to that process and which now is in FIN_WAIT_2. I know some people will say "impossible", but here is the proof
- I used to be a network guy, even doing (Linux) kernel programming of TCP code (Firewall) so I know at least a little bit what I'm talking about even if that was some time ago. I feel I have to say that because any previous such reports/discussions that I
could find where met with incredulity.
I run Wireshark so I can SEE the traffic, and it is all on the port that "netstat -an" lists as "FIN_WAIT_2".
Background: This is about twitch.tv and Video-On-Demand (not live) streams. I'm using the latest Flash and Firefox. Even when I make sure (process list) that both Firefox and the Flash plugin are gone network traffic continues to max out my 16Mbit connection.
The connections (which are TCP -> HTTP) are to "Level 3 Communications" (a company) data centers, which is where twitch hosts them (I verified all of this, and besides, as I said, I can see the traffic with Wireshark).
How can I prevent this useless traffic? How is that possible anyway? Yes I know it's ultimately not Windows' fault, but I have no access to twitch video-on-demand servers nor to the code of their flash video player. I *could* manually add a Firewall block
for that port, but I'm not even sure that would prevent the server from continuing to send the packets, only that I don't see them - and this "denial of service attack" on my Internet connection would still be there.
-- I CANNOT POST LINKS, THE FORUM WON'T ALLOW IT! -- So links removed.
I have found this, and there is one sentence that gives me pause:
[LINK to MSDN]
"If an acceptable TCP segment arrives on the connection before the FIN_WAIT_2 timer expires, the offload target restarts the FIN_WAIT_2 timer."
Since there ARE such packets coming form the server (lots of them!) it seems that may be what happens, and the FIN_WAIT_2 timer doesn't expire?
FOUND LATER:
Could be this is not twitch.tv specific, since I've been watching my system more closely I have noticed that it may be a more wide-spread issue.
I found an issue on the Google Forums regarding Chrome 35 (current version) and one from some very angry customers in the Bitdefender forums.

I tried but I am not allowed to post links!!! So see the bottom of this post.
Here is what I did:
- Start Firefox (29.0.1)
- Load a (several hours long) VOD from twitch (http://www.twitch.tv/wcs_america/profile/pastBroadcasts)
- About twitch VODs: They are stored on "Level 3 Communication" (the hosting company) servers in 30min chunks. So crossing a 30min threshold (30min, 1hr, 1.5hr, etc.) causes the twitch video player to make a new connection to the same or a different streaming
server
- Click on the timeline in the video on several points in different 30min sections of the VOD to force it to close the current and open a new video-stream connection
- Bandwidth use went through the roof (max. of 16Mbit connection)
- Close Firefox - and also make sure that there is no Flash plugin running any more. VERIFIED: Neither Firefox nor Flash running.
- Bandwidth still max (EVEN NOW OVER 10 minutes later!!!). Using Wireshark I could (AND CAN) see it was (IS) all streaming traffic to 199.93.41.253:80 and 8.254.72.126:80 ("Level 3 Communications", ISP for twitch TV)
Here is just a few lines from what I get in Wireshark (still):
10   0.003838000   192.168.111.30   199.93.41.253   TCP   54   55062 > http [ACK] Seq=1 Ack=4357 Win=65340 Len=0
11   0.004567000   199.93.41.253   192.168.111.30   HTTP   1506   Continuation or non-HTTP traffic
12   0.005264000   199.93.41.253   192.168.111.30   HTTP   1506   Continuation or non-HTTP traffic
Wireshark shows nothing but this traffic "for miles", this is what uses next to 100% of my incoming bandwidth.
Aktive Verbindungen
Proto Lokale Adresse         Remoteadresse          Status           PID
TCP    0.0.0.0:80             0.0.0.0:0              ABH™REN         3220
[Skype.exe]
TCP    0.0.0.0:135            0.0.0.0:0              ABH™REN         672
RpcSs
[svchost.exe]
TCP    0.0.0.0:443            0.0.0.0:0              ABH™REN         3220
[Skype.exe]
TCP    0.0.0.0:445            0.0.0.0:0              ABH™REN         4
Es konnten keine Besitzerinformationen abgerufen werden.
TCP    0.0.0.0:554            0.0.0.0:0              ABH™REN         5772
[wmpnetwk.exe]
TCP    0.0.0.0:902            0.0.0.0:0              ABH™REN         4148
[vmware-authd.exe]
TCP    0.0.0.0:912            0.0.0.0:0              ABH™REN         4148
[vmware-authd.exe]
TCP    0.0.0.0:2869           0.0.0.0:0              ABH™REN         4
Es konnten keine Besitzerinformationen abgerufen werden.
TCP    0.0.0.0:5357           0.0.0.0:0              ABH™REN         4
Es konnten keine Besitzerinformationen abgerufen werden.
TCP    0.0.0.0:8885           0.0.0.0:0              ABH™REN         4
Es konnten keine Besitzerinformationen abgerufen werden.
TCP    0.0.0.0:10243          0.0.0.0:0              ABH™REN         4
Es konnten keine Besitzerinformationen abgerufen werden.
TCP    0.0.0.0:10928          0.0.0.0:0              ABH™REN         3220
[Skype.exe]
TCP    0.0.0.0:49152          0.0.0.0:0              ABH™REN         772
[wininit.exe]
TCP    0.0.0.0:49153          0.0.0.0:0              ABH™REN         1044
eventlog
[svchost.exe]
TCP    0.0.0.0:49154          0.0.0.0:0              ABH™REN         1168
Schedule
[svchost.exe]
TCP    0.0.0.0:49157          0.0.0.0:0              ABH™REN         840
[services.exe]
TCP    0.0.0.0:49171          0.0.0.0:0              ABH™REN         860
[lsass.exe]
TCP    127.0.0.1:52001        0.0.0.0:0              ABH™REN         3040
[BtvStack.exe]
TCP    127.0.0.1:52001        127.0.0.1:54641        HERGESTELLT     3040
[BtvStack.exe]
TCP    127.0.0.1:52001        127.0.0.1:54644        HERGESTELLT     3040
[BtvStack.exe]
TCP    127.0.0.1:52001        127.0.0.1:54645        HERGESTELLT     3040
[BtvStack.exe]
TCP    127.0.0.1:52001        127.0.0.1:54646        HERGESTELLT     3040
[BtvStack.exe]
TCP    127.0.0.1:54641        127.0.0.1:52001        HERGESTELLT     3040
[BtvStack.exe]
TCP    127.0.0.1:54644        127.0.0.1:52001        HERGESTELLT     3040
[BtvStack.exe]
TCP    127.0.0.1:54645        127.0.0.1:52001        HERGESTELLT     3040
[BtvStack.exe]
TCP    127.0.0.1:54646        127.0.0.1:52001        HERGESTELLT     3040
[BtvStack.exe]
TCP    192.168.111.30:139     0.0.0.0:0              ABH™REN         4
Es konnten keine Besitzerinformationen abgerufen werden.
TCP    192.168.111.30:10928   84.187.0.22:54835      HERGESTELLT     3220
[Skype.exe]
TCP    192.168.111.30:54637   157.55.56.173:40022    HERGESTELLT     3220
[Skype.exe]
TCP    192.168.111.30:54638   157.55.133.143:12350   HERGESTELLT     3220
[Skype.exe]
TCP    192.168.111.30:54639   157.56.192.84:443      HERGESTELLT     3220
[Skype.exe]
TCP    192.168.111.30:54900   173.194.69.104:443     WARTEND         0
TCP    192.168.111.30:54902   173.194.69.94:443      WARTEND         0
TCP    192.168.111.30:54969   54.187.195.216:80      WARTEND         0
TCP    192.168.111.30:55059   75.126.166.164:443     WARTEND         0
TCP    192.168.111.30:55062   199.93.41.253:80       FIN_WARTEN_2    9528
[System]
TCP    192.168.111.30:55064   5.10.73.69:80          WARTEND         0
TCP    192.168.111.30:55103   173.194.35.168:443     WARTEND         0
TCP    192.168.111.30:55131   173.194.44.23:443      WARTEND         0
TCP    192.168.111.30:55132   173.194.44.5:443       WARTEND         0
TCP    192.168.111.30:55133   66.196.116.112:443     FIN_WARTEN_2    9528
[System]
TCP    192.168.111.30:55135   199.93.41.253:80       WARTEND         0
TCP    192.168.111.30:55137   199.93.41.253:80       FIN_WARTEN_2    9528
[System]
TCP    192.168.111.30:55138   54.209.30.123:80       WARTEND         0
TCP    192.168.111.30:55139   8.254.72.126:80        FIN_WARTEN_2    9528
[System]
TCP    192.168.111.30:55141   199.9.253.5:80         WARTEND         0
TCP    192.168.111.30:55142   8.254.72.126:80        FIN_WARTEN_2    9528
[System]
TCP    192.168.111.30:55143   8.254.72.126:80        WARTEND         0
TCP    192.168.111.30:55144   8.254.72.126:80        WARTEND         0
TCP    192.168.111.30:55145   8.254.72.126:80        FIN_WARTEN_2    9528
[System]
TCP    192.168.111.30:55146   8.254.72.126:80        WARTEND         0
TCP    192.168.111.30:55147   8.254.72.126:80        WARTEND         0
TCP    192.168.111.30:55149   199.9.253.5:80         WARTEND         0
TCP    192.168.111.30:55150   8.254.72.126:80        FIN_WARTEN_2    9528
[System]
TCP    192.168.111.30:55151   8.254.72.126:80        WARTEND         0
TCP    192.168.111.30:55152   8.254.72.126:80        WARTEND         0
TCP    192.168.111.30:55153   8.254.72.126:80        WARTEND         0
TCP    192.168.125.1:139      0.0.0.0:0              ABH™REN         4
Es konnten keine Besitzerinformationen abgerufen werden.
TCP    192.168.238.1:139      0.0.0.0:0              ABH™REN         4
Es konnten keine Besitzerinformationen abgerufen werden.
TCP    [::]:135               [::]:0                 ABH™REN
672
RpcSs
[svchost.exe]
TCP    [::]:445               [::]:0                 ABH™REN
4
Es konnten keine Besitzerinformationen abgerufen werden.
TCP    [::]:554               [::]:0                 ABH™REN
5772
[wmpnetwk.exe]
TCP    [::]:2869              [::]:0                 ABH™REN
4
Es konnten keine Besitzerinformationen abgerufen werden.
TCP    [::]:3587              [::]:0                 ABH™REN
6584
p2pimsvc
[svchost.exe]
TCP    [::]:5357              [::]:0                 ABH™REN
4
Es konnten keine Besitzerinformationen abgerufen werden.
TCP    [::]:8885              [::]:0                 ABH™REN
4
Es konnten keine Besitzerinformationen abgerufen werden.
TCP    [::]:10243             [::]:0                 ABH™REN
4
Es konnten keine Besitzerinformationen abgerufen werden.
TCP    [::]:49152             [::]:0                 ABH™REN
772
[wininit.exe]
TCP    [::]:49153             [::]:0                 ABH™REN
1044
eventlog
[svchost.exe]
TCP    [::]:49154             [::]:0                 ABH™REN
1168
Schedule
[svchost.exe]
TCP    [::]:49157             [::]:0                 ABH™REN
840
[services.exe]
TCP    [::]:49171             [::]:0                 ABH™REN
860
[lsass.exe]
TCP    [::1]:49155            [::]:0                 ABH™REN
2720
[jhi_service.exe]
UDP    0.0.0.0:443            *:*
3220
[Skype.exe]
UDP    0.0.0.0:500            *:*
2416
[avmike.exe]
UDP    0.0.0.0:3544           *:*
1168
iphlpsvc
[svchost.exe]
UDP    0.0.0.0:3702           *:*
1124
EventSystem
[svchost.exe]
UDP    0.0.0.0:3702           *:*
2580
FDResPub
[svchost.exe]
UDP    0.0.0.0:3702           *:*
1124
EventSystem
[svchost.exe]
UDP    0.0.0.0:3702           *:*
2580
FDResPub
[svchost.exe]
UDP    0.0.0.0:4500           *:*
2416
[avmike.exe]
UDP    0.0.0.0:5004           *:*
5772
[wmpnetwk.exe]
UDP    0.0.0.0:5005           *:*
5772
[wmpnetwk.exe]
UDP    0.0.0.0:10928          *:*
3220
[Skype.exe]
UDP    0.0.0.0:50429          *:*
1124
EventSystem
[svchost.exe]
UDP    0.0.0.0:64363          *:*
2416
[avmike.exe]
UDP    0.0.0.0:64364          *:*
2580
FDResPub
[svchost.exe]
UDP    127.0.0.1:1900         *:*
2580
SSDPSRV
[svchost.exe]
UDP    127.0.0.1:58642        *:*
3220
[Skype.exe]
UDP    127.0.0.1:62775        *:*
2580
SSDPSRV
[svchost.exe]
UDP    192.168.111.30:137     *:*
4
Es konnten keine Besitzerinformationen abgerufen werden.
UDP    192.168.111.30:138     *:*
4
Es konnten keine Besitzerinformationen abgerufen werden.
UDP    192.168.111.30:1900    *:*
2580
SSDPSRV
[svchost.exe]
UDP    192.168.111.30:58339   *:*
1168
iphlpsvc
[svchost.exe]
UDP    192.168.111.30:62774   *:*
2580
SSDPSRV
[svchost.exe]
UDP    192.168.125.1:137      *:*
4
Es konnten keine Besitzerinformationen abgerufen werden.
UDP    192.168.125.1:138      *:*
4
Es konnten keine Besitzerinformationen abgerufen werden.
UDP    192.168.125.1:1900     *:*
2580
SSDPSRV
[svchost.exe]
UDP    192.168.238.1:137      *:*
4
Es konnten keine Besitzerinformationen abgerufen werden.
UDP    192.168.238.1:138      *:*
4
Es konnten keine Besitzerinformationen abgerufen werden.
UDP    192.168.238.1:1900     *:*
2580
SSDPSRV
[svchost.exe]
UDP    [::]:500               *:*
1168
IKEEXT
[svchost.exe]
UDP    [::]:3540              *:*
6584
p2pimsvc
[svchost.exe]
UDP    [::]:3702              *:*
1124
EventSystem
[svchost.exe]
UDP    [::]:3702              *:*
1124
EventSystem
[svchost.exe]
UDP    [::]:3702              *:*
2580
FDResPub
[svchost.exe]
UDP    [::]:3702              *:*
2580
FDResPub
[svchost.exe]
UDP    [::]:4500              *:*
1168
IKEEXT
[svchost.exe]
UDP    [::]:5004              *:*
5772
[wmpnetwk.exe]
UDP    [::]:5005              *:*
5772
[wmpnetwk.exe]
UDP    [::]:50430             *:*
1124
EventSystem
[svchost.exe]
UDP    [::]:64365             *:*
2580
FDResPub
[svchost.exe]
UDP    [::1]:1900             *:*
2580
SSDPSRV
[svchost.exe]
UDP    [::1]:62773            *:*
2580
SSDPSRV
[svchost.exe]
UDP    [fe80::35d2:f3d9:41a0:15f4%11]:1900 *:*
2580
SSDPSRV
[svchost.exe]
UDP    [fe80::35d2:f3d9:41a0:15f4%11]:62772 *:*
2580
SSDPSRV
[svchost.exe]
UDP    [fe80::4d27:be51:1436:d8fb%26]:1900 *:*
2580
SSDPSRV
[svchost.exe]
UDP    [fe80::a507:ac5b:bc90:374b%27]:1900 *:*
2580
SSDPSRV
[svchost.exe]

C3640 stops processing traffic over ethernet

Hi
I have a C3640 with a NM-2FE2W-V2, neighboring with a C2621 over Fa0/1. They both speak OSPF with each other.
Problem: Within a period of 1-2 hours, the Fa0/1 stops receiving, or, let's say, processing incoming traffic.
The strange thing is, the problem does not occur if I connect a simple PC to the Fa0/1; it will continue to work uninterruptedly.
Additional info: The two routers have fixed settings 100/full. Until the problem occurs, traffic is being processed normally by the C3640. Using a sniffer, I could prove that during problem occurence, traffic (e.g. OSPF, CDP, ICMP...) still gets to the Fa0/1. It just simply does not increase the incoming packet counter anymore. Though the int will stay in up/up mode. Only a shut/no shut solves the problem, unplugging/plugging the ethernet cable doesn't.
Running IOS 12.2(28a).
Does anyone have an idea? Thanks for any help.
Toni

Hi m.lammerse
I wish to believe a software upgrade would help. After all, I upgraded this router to the second last available GD release to being able to support the NM module. The router is in a productive environment and I have to keep downtime as low as possible.
See the sh int fa0/1 output below. Notice that it is exactly one week ago, when I cleared the counters. At that time, the problem was already present. You'll notice, that the interface still continues to send traffic.
I was not able to spot any sign in the buffered log which could have helped me to figure out the reason.
chreh-router1#sh int fa0/1
FastEthernet0/1 is up, line protocol is up
Hardware is AmdFE, address is 0009.7c9b.5b02 (bia 0009.7c9b.5b02)
Description: darkfiber to chgra-router1
Internet address is 192.168.20.9/30
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 100Mb/s, 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input 1w0d, output 00:00:00, output hang never
Last clearing of "show interface" counters 1w0d
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog
0 input packets with dribble condition detected
135580 packets output, 12700782 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
chreh-router1#

[Solved] ntop not working?

I'm trying to run ntop on on of my boxes at work, but it seems to dissapear as soon as it goes into daemon mode...
In /var/log/ntop.log:
Thu Jan 17 10:27:57 2008 Initializing ntop
Thu Jan 17 10:27:57 2008 No patterns to load: protocol guessing disabled.
Thu Jan 17 10:27:57 2008 Checking eth1 for additional devices
Thu Jan 17 10:27:57 2008 Resetting traffic statistics for device eth1
Thu Jan 17 10:27:57 2008 Initializing device eth1 (0)
Thu Jan 17 10:27:57 2008 DLT: Device 0 [eth1] is 1, mtu 1514, header 14
Thu Jan 17 10:27:57 2008 Initializing gdbm databases
Thu Jan 17 10:27:57 2008 VENDOR: Loading MAC address table.
Thu Jan 17 10:27:57 2008 VENDOR: Checking for MAC address table file
Thu Jan 17 10:27:57 2008 VENDOR: File '/etc/ntop/specialMAC.txt.gz' does not need to be reloaded
Thu Jan 17 10:27:57 2008 VENDOR: ntop continues ok
Thu Jan 17 10:27:57 2008 VENDOR: Checking for MAC address table file
Thu Jan 17 10:27:57 2008 VENDOR: File '/etc/ntop/oui.txt.gz' does not need to be reloaded
Thu Jan 17 10:27:57 2008 VENDOR: ntop continues ok
Thu Jan 17 10:27:57 2008 Fingerprint: Loading signature file
Thu Jan 17 10:27:57 2008 Fingerprint: Checking for Fingerprint file... file
Thu Jan 17 10:27:57 2008 Fingerprint: Loading file '/etc/ntop/etter.finger.os.gz'
Thu Jan 17 10:27:57 2008 Fingerprint: ...loaded 1765 records
Thu Jan 17 10:27:57 2008 INIT: Bye bye: I'm becoming a daemon...
Thu Jan 17 10:27:57 2008 INIT: Parent process is exiting (this is normal)
Once it finishes this sequence, 'ps -ef' reveals not a single ntop process.
From /etc/conf.d/ntop:
# Paramaters passed to ntop by init
# -d -- to daemonize. (without this, the init script will not work)
# Parameters to be passed to ntop
# -i -- comma separated list of interfaces to monitor
# -w -- port to listen on (default 3000)
NTOP_ARGS="-d -i eth1 -w 3000"
# Log file for ntop
NTOP_LOG="/var/log/ntop.log"
I added the '-d' myself, but that seems to make no difference.
Because there is no 'ntop' process running, naturally the webserver http://localhost:3000 isn't running either.
What on earth am I missing or doing wrong?
Last edited by ReaphSharc (2008-01-31 15:01:48)

1) delete ntop admin password is exist:
# rm /var/ntop/ntop_pw.db
2) only in first run add admin password with:
# ntop -A
3) start as daemon service
# /etc/rc.d/ntop start
salu2 --cesar

Can't get rid of a TX - message keeps appearing and being processed by OSB

I have some sort of a poison message or TX I can't flush. Every 10 seconds I get a log message like the second one below, and the number of pending messages in multiple places and OSB proxy service messages processed keep climbing - all without producing any new messages on my part. I've tried deleting the default server store on the OSB managed server and the filestore for the JMS server. No luck.
When this first started happening, the error messages looked like the first one below. Something I did caused the change, I assume. However, it's the same TX ID throughout.
So, first, how can I get rid of this thing? It's driving me nuts and keeping me from closing out a POC.
Second, why is it happening? I have one suspicion - could it be because that somehow we configured mutiple domains with the same name for a distributed application? It's not my normal practice but it happened. These domains don't communicate directly, but there are domains that need to communicate with both. So I'm guessing the name ambiguity may be hurting us. Just a guess, though.
In this case, the sgosb domain's proxy service (this domain name is unique) is receiving messages from a queue resident in the pega_domain in Singapore and another proxy service is putting a message to another queue in the pega_domain in the UK. This is not in a single TX; the first proxy service forwards the message to a queue in the sgosb_domain, the second proxy service gets that message and puts it into the other pega_domain. It's an XA TX for each proxy service.
Just to make it more fun, the sgosb_domain has another proxy service reading from a different queue and forwarding it to a queue in the third pega_domain in the US.
TIA for any help or insight.
Oh yes, the OSB domain is WLS 10.3.4, while the pega_domains are WLS 10.3.2
Original error message
####<Apr 13, 2011 4:32:13 AM GMT> <Error> <EJB> <sg01app510> <sgosb_1> <[ACTIVE] ExecuteThread: '7' for queue: 'weblogic.kernel.Default (self-tuning)'>
<<anonymous>> <> <92f54a30d60e6302:-4b6d523c:12f4cfeaabc:-8000-0000000000000123> <1302669133597> <BEA-010026> <Exception occurred during commit of
transaction Xid=BEA1-039B0B6D3D0E77C1B135(1898471720),Status=Rolled back. [Reason=Unknown],numRepliesOwedMe=0,numRepliesOwedOthers=0,seconds since
begin=0,seconds left=600,XAServerResourceInfo[WLStore_pega_domain_ProcessEventJMS_Store_mgd1]=(ServerResourceInfo[WLStore_pega_domain_ProcessEventJMS_Store_mgd1]=
(state=new,assigned=none),xar=null,re-Registered = false),SCInfo[sgosb_domain+sgosb_1]=(state=rolledback),SCInfo[pega_domain+pega_1]=(state=rolledback),properties=
({}),OwnerTransactionManager=ServerTM[ServerCoordinatorDescriptor=(CoordinatorURL=sgosb_1+152.64.128.243:22110+sgosb_domain+t3+, XAResources={eis/tibjms/Topic,
WLStore_sgosb_domain_FileStore_auto_1, eis/aqjms/Queue, eis/wls/Queue, eis/tibjms/Queue, WLStore_sgosb_domain__WLS_sgosb_1, eis/AQ/aqSample, eis/aqjms/Topic,
eis/pramati/Queue, eis/sunmq/Queue, WLStore_sgosb_domain_WseeFileStore_auto_1, WLStore_sgosb_domain_MesssageForwardingJMS_Store_mgd1,
WSATGatewayRM_sgosb_1_sgosb_domain, eis/jbossmq/Queue, eis/activemq/Queue, eis/fioranomq/Topic, eis/tibjmsDirect/Topic, eis/wls/Topic,
eis/tibjmsDirect/Queue, eis/Apps/Apps, eis/webspheremq/Queue},NonXAResources={})],CoordinatorURL=pega_1+nj09mhm5078:22111+pega_domain+t3+):
javax.transaction.RollbackException: This transaction does not exist on the coordinating server. It was probably rolled back and forgotten.
        at weblogic.rjvm.ResponseImpl.unmarshalReturn(ResponseImpl.java:234)
        at weblogic.rmi.internal.BasicRemoteRef.invoke(BasicRemoteRef.java:223)
        at weblogic.transaction.internal.CoordinatorImpl_1032_WLStub.commit(Unknown Source)
        at weblogic.transaction.internal.TransactionImpl$1.run(TransactionImpl.java:331)
        at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:363)
        at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:146)
        at weblogic.transaction.internal.SecureAction.runAction(SecureAction.java:72)
        at weblogic.transaction.internal.TransactionImpl.commit(TransactionImpl.java:327)
        at weblogic.transaction.internal.ServerTransactionImpl.internalCommit(ServerTransactionImpl.java:252)
        at weblogic.transaction.internal.ServerTransactionImpl.commit(ServerTransactionImpl.java:239)
        at weblogic.ejb.container.internal.MDListener.execute(MDListener.java:553)
        at weblogic.ejb.container.internal.MDListener.transactionalOnMessage(MDListener.java:424)
        at weblogic.ejb.container.internal.MDListener.onMessage(MDListener.java:326)
        at weblogic.jms.client.JMSSession.onMessage(JMSSession.java:4659)
        at weblogic.jms.client.JMSSession.execute(JMSSession.java:4345)
        at weblogic.jms.client.JMSSession.executeMessage(JMSSession.java:3821)
        at weblogic.jms.client.JMSSession.access$000(JMSSession.java:115)
        at weblogic.jms.client.JMSSession$UseForRunnable.run(JMSSession.java:5170)
        at weblogic.work.SelfTuningWorkManagerImpl$WorkAdapterImpl.run(SelfTuningWorkManagerImpl.java:528)
        at weblogic.work.ExecuteThread.execute(ExecuteThread.java:207)
        at weblogic.work.ExecuteThread.run(ExecuteThread.java:176)
Caused by: javax.transaction.RollbackException: This transaction does not exist on the coordinating server. It was probably rolled back and forgotten.
        at weblogic.transaction.internal.CoordinatorImpl.commit(CoordinatorImpl.java:94)
        at weblogic.transaction.internal.CoordinatorImpl_WLSkel.invoke(Unknown Source)
        at weblogic.rmi.internal.BasicServerRef.invoke(BasicServerRef.java:589)
        at weblogic.rmi.internal.BasicServerRef$1.run(BasicServerRef.java:477)
        at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:363)
        at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:147)
        at weblogic.rmi.internal.BasicServerRef.handleRequest(BasicServerRef.java:473)
        at weblogic.rmi.internal.wls.WLSExecuteRequest.run(WLSExecuteRequest.java:118)
        at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
        at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
The error message I'm getting now
####<Apr 13, 2011 4:51:38 AM GMT> <Error> <EJB> <sg01app510> <sgosb_1> <[ACTIVE] ExecuteThread: '18' for queue: 'weblogic.kernel.Default (self-tuning)'> <<anonymous>> <>
<92f54a30d60e6302:-42808c28:12f4d3173cb:-8000-0000000000000032> <1302670298730> <BEA-010026> <Exception occurred during commit of transaction
Xid=BEA1-0011D0679BA5074B8E12(1930603846),Status=Rolled back. [Reason=javax.transaction.xa.XAException],numRepliesOwedMe=0,numRepliesOwedOthers=0,seconds since begin=0,seconds
left=60,XAServerResourceInfo[WLStore_sgosb_domain_MesssageForwardingJMS_Store_mgd1]=(ServerResourceInfo[WLStore_sgosb_domain_MesssageForwardingJMS_Store_mgd1]=
(state=rolledback,assigned=sgosb_1),xar=WLStore_sgosb_domain_MesssageForwardingJMS_Store_mgd1239571724,re-Registered =
false),XAServerResourceInfo[WLStore_pega_domain_ProcessEventJMS_Store_mgd1]=(ServerResourceInfo[WLStore_pega_domain_ProcessEventJMS_Store_mgd1]=
(state=rolledback,assigned=pega_1),xar=null,re-Registered = false),SCInfo[sgosb_domain+sgosb_1]=(state=rolledback),SCInfo[pega_domain+pega_1]=(state=rolledback),properties=
({}),OwnerTransactionManager=ServerTM[ServerCoordinatorDescriptor=(CoordinatorURL=sgosb_1+152.64.128.243:22110+sgosb_domain+t3+, XAResources={eis/tibjms/Topic,
WLStore_sgosb_domain_FileStore_auto_1, eis/aqjms/Queue, eis/wls/Queue, eis/tibjms/Queue, WLStore_sgosb_domain__WLS_sgosb_1, eis/AQ/aqSample, eis/aqjms/Topic, eis/pramati/Queue, eis/sunmq
/Queue, WLStore_sgosb_domain_WseeFileStore_auto_1, WLStore_sgosb_domain_MesssageForwardingJMS_Store_mgd1, WSATGatewayRM_sgosb_1_sgosb_domain, eis/jbossmq/Queue, eis/activemq
/Queue, eis/fioranomq/Topic, eis/tibjmsDirect/Topic, eis/wls/Topic, eis/tibjmsDirect/Queue, eis/Apps/Apps, eis/webspheremq/Queue},NonXAResources=
{})],CoordinatorURL=sgosb_1+152.64.128.243:22110+sgosb_domain+t3+): weblogic.transaction.RollbackException: Unknown reason
        at weblogic.transaction.internal.TransactionImpl.throwRollbackException(TransactionImpl.java:1881)
        at weblogic.transaction.internal.ServerTransactionImpl.internalCommit(ServerTransactionImpl.java:345)
        at weblogic.transaction.internal.ServerTransactionImpl.commit(ServerTransactionImpl.java:239)
        at weblogic.ejb.container.internal.MDListener.execute(MDListener.java:553)
        at weblogic.ejb.container.internal.MDListener.transactionalOnMessage(MDListener.java:424)
        at weblogic.ejb.container.internal.MDListener.onMessage(MDListener.java:326)
        at weblogic.jms.client.JMSSession.onMessage(JMSSession.java:4659)
        at weblogic.jms.client.JMSSession.execute(JMSSession.java:4345)
        at weblogic.jms.client.JMSSession.executeMessage(JMSSession.java:3821)
        at weblogic.jms.client.JMSSession.access$000(JMSSession.java:115)
        at weblogic.jms.client.JMSSession$UseForRunnable.run(JMSSession.java:5170)
        at weblogic.work.SelfTuningWorkManagerImpl$WorkAdapterImpl.run(SelfTuningWorkManagerImpl.java:528)
        at weblogic.work.ExecuteThread.execute(ExecuteThread.java:207)
        at weblogic.work.ExecuteThread.run(ExecuteThread.java:176)
Caused by: javax.transaction.xa.XAException
        at weblogic.store.gxa.internal.GXAResourceImpl.prepare(GXAResourceImpl.java:1227)
        at weblogic.transaction.internal.XAServerResourceInfo.prepare(XAServerResourceInfo.java:1295)
        at weblogic.transaction.internal.XAServerResourceInfo.prepare(XAServerResourceInfo.java:500)
        at weblogic.transaction.internal.ServerSCInfo.startPrepare(ServerSCInfo.java:380)
        at weblogic.transaction.internal.ServerTransactionImpl.localPrepare(ServerTransactionImpl.java:2593)
        at weblogic.transaction.internal.ServerTransactionImpl.localPrepare(ServerTransactionImpl.java:1321)
        at weblogic.transaction.internal.SubCoordinatorImpl.startPrepare(SubCoordinatorImpl.java:183)
        at weblogic.transaction.internal.CoordinatorImpl_WLSkel.invoke(Unknown Source)
        at weblogic.rmi.internal.BasicServerRef.invoke(BasicServerRef.java:589)
        at weblogic.rmi.internal.BasicServerRef$1.run(BasicServerRef.java:477)
        at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:363)
        at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:147)
        at weblogic.rmi.internal.BasicServerRef.handleRequest(BasicServerRef.java:473)
        at weblogic.rmi.internal.wls.WLSExecuteRequest.run(WLSExecuteRequest.java:118)
        at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
        at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
.>Edited by: SteveElkind on Apr 13, 2011 5:50 AM

Tom,
Thanks! Succinct and easy to understand as ever.
Yup, that covers it - I had also just seen this in the docs after looking at atheek1's earlier response (thanks to him/her as well). It's covered almost as clearly there as you state it here (http://download.oracle.com/docs/cd/E11035_01/wls100/jta/trxcon.html).
While the ESB domains meet all of those requirements (except for cross-domain security configuration), each of the other two sets of domains (3 in each set) do not meet the naming uniqueness criteria for domain and server names; they do for JMS server names. I saw the store names in the TX identifier string as included resource, and assumed they might play a part - that's why I changed them. As you say, an unnecessary change. Oh well - it was an easy one.
My normal practice has been for unique names in the past, due to problems I had years ago with cross-domain JMS traffic in an earlier WLS version. I guess it's the wrong time to have forgotten that lesson.
Does anyone know of a quick way of changing a domain name quickly without rebuilding the domain? In the past WLST resulted in incomplete copies for me, is that still a problem? Server names are easy, just some global search-and-replace in the config.xml file (and in the management scripts, too)
/Steve

Image processing over wireless

Hi,
One of our subsidaries has a setup where continuous video stream is generated from certain application servers processing real time image processing.
The setup goes this way; 3 PC's which run these image processing & are connected to a 3750G switch.
This switch is uplinked to an access point which then carries all these over wireless to the image processing main server.
About two weeks ago, when they tested this ,all 3 PC's had issues running together when operators viewed/worked upon the images on them.
When either one or two of them is turned off, the rest works fine with no disturbance( intermediate stop & start of images ).
Please help with suggestions on what could be the cause. I suspect bandwidth, but since this doesn't cover any WAN links, i doubt that bandwidth is actually the problem.
Thanks in advance.

It depends. QoS will help if your having congestion on the wired side. WMM QoS will help for over the air. I would look at the switch port and see if you see drops on both the map and rap side. You might just be over utilizing the backhaul. Remember that it is half duplex link so that can be an issue also. I had an install with regular AP's and 3gb video uploads within 30 minutes and the only way to achieve that is only allowing 4-5 clients per AP. the testing you have done seems to show that the max you can do over that link is 2. How much other traffic is using the wireless. Maybe try to isolate those traffic on a separate RAP/MAP pair using AP Groups.
Sent from Cisco Technical Support iPhone App

NTOP Traffic Process

Similar Messages

Maybe you are looking for