> hmm, sounds you have devices in your network building an byte-swapped
> and therefore wrong icmp mask-reply.
> are these devices with the 0.255.255.255 netmask reply from the same
> manufacturer ?
Thomas> due to the big number of devices difficult to answer.
Thomas> We have a complete Fiber Optic network and currently uses
Thomas> FOIRL NIC only from Allied Telesyn (except for servers with
Thomas> fast ethernet). Most used NIC modell is the AT-2450FT, but we
Thomas> also have some AT-1500 and AT-1700 and a few 2450F cards. All
Thomas> with the latest drivers. Back in the office I will check
Thomas> which NIC modell the failed machines has.
this could be helpful.
i remember a byte swap problem we had with some synoptics devices,
which had wrong bytesex in unreachable and time-exceeded replies.
however, another thought would be to check with another tool if tkined
is broken (which i don't believe ;-) or the devices are to blame.
tcpdump output would be helpful; eg:
> schoenfr@spog:schoenfr 6 > tcpdump -n icmp
> tcpdump: listening on eth0
> 16:46:40.310422 194.45.135.2 > 194.45.135.102: icmp: address mask request
> 16:46:40.310422 194.45.135.102 > 194.45.135.2: icmp: address mask is 0xffffffc0 (DF)
to have a look at the traffic itself.
anyway, i'll add an work-around to nmicmpd.c to byteswap such an
impossible answer (leading zero bits, followed by ones), so this can
be handled as expected.
Erik
-- !! This message is brought to you via the `tkined & scotty' mailing list. !! Please do not reply to this message to unsubscribe. To subscribe or !! unsubscribe, send a mail message to <tkined-request@ibr.cs.tu-bs.de>. !! See http://wwwsnmp.cs.utwente.nl/~schoenw/scotty/ for more information.