Subject: Re: [OSPF] SR 612546021 - SNMP responses for the "ospfNbrTable" mib variable

From: Paul Wells <[email-masked]>
Date: Fri, 02 Oct 2009 12:10:10 -0500

[followups to cs-ospf]

Hi Joe,

Responses inline:

Anirban Karmakar (akarmaka) wrote:
> Adding ospf mailer list
> 
>  
> 
> *From:* Joe Reekers (jreekers)
> *Sent:* Friday, October 02, 2009 9:01 PM
> *To:* cs-snmp (mailer list); cse-tac-snmp(mailer list)
> *Subject:* SR 612546021 - SNMP responses for the "ospfNbrTable" mib variable
> 
>  
> 
> *2nd try - expanding audience*
> 
>  
> 
>  
> 
> 7206VXR IOS 12.3(22)
> 
>  
> 
> Hi Team.
> 
>  
> 
> I need some assistance with this case. 
> 
>  
> 
> Polling of the "ospfNbrTable" mib variable is yeilding an improper 
> response. I believe that the SNMP response should match with the router 
> show command as seen by dumping OSPF neighbours.
> 
> For example,
> 
> On a router (Bucaramanga), they have the following OSPF neighbours as 
> seen from the router CLI:
> 
> cobuar1#sh ip ospf neigh
> 
> Neighbor ID     Pri   State           Dead Time     Address           
> Interface
> 
> 172.28.4.40       1   FULL/DR         00:00:30    10.166.28.6      
> ATM3/0.19046
> 10.10.66.32       0   FULL/  -          00:00:37    10.10.66.32       
> Serial2/0:0 
> 
> 10.10.66.32       0   FULL/  -          
> 00:00:39    10.10.66.32       Serial2/4:0
> 
> 
> However the IP addresses show up as 0.0.0.0 in SNMP queries on ospfNbrTable
> 
> These results should match with entries under "Address" column above:
> 
> ospf.ospfNbrTable.ospfNbrEntry.ospfNbrIpAddr.10.166.28.6.0 : IpAddress: 
> 10.166.28.6
> 
> ospf.ospfNbrTable.ospfNbrEntry.ospfNbrIpAddr.0.0.0.0.21 : IpAddress: 0.0.0.0
> ospf.ospfNbrTable.ospfNbrEntry.ospfNbrIpAddr.0.0.0.0.23 : IpAddress: 0.0.0.0
> 
> These results should match with entries under "Neighbor ID" column above.
> 
> ospf.ospfNbrTable.ospfNbrEntry.ospfNbrRtrId.10.166.28.6.0 : IpAddress: 
> 172.28.4.40
> 
> ospf.ospfNbrTable.ospfNbrEntry.ospfNbrRtrId.0.0.0.0.21 : IpAddress: 
> 10.10.66.32
> ospf.ospfNbrTable.ospfNbrEntry.ospfNbrRtrId.0.0.0.0.23 : IpAddress: 
> 10.10.66.32
> 
> This MIB object states the following:
> 
> ospfNbrIpAddr OBJECT-TYPE
>        SYNTAX       IpAddress
>        MAX-ACCESS   read-only -- read-only since originally an
>                               -- SMIv1 index
>        STATUS       current
>        DESCRIPTION
>           "The IP address this neighbor is using in its
>           IP source address.  Note that, on addressless
>           links, this will not be 0.0.0.0 but the
>           address of another of the neighbor's interfaces."
> 
>        ::= { ospfNbrEntry 1 }
> 
>  
> 
> At first, I thought this may be CSCdz53031, but that's been ruled-out 
> based on the show tech received that doesn't show unused ospf process 
> definitions.
> 
>  
> 
> So, my questions are:
> 
>  
> 
> 1.  In the first poll, you see that the IP is included in the poll, but 
> the instance is "0", but it returns a value...is that the correct way to 
> poll this object?
> 
> (ex. ospf.ospfNbrTable.ospfNbrEntry.ospfNbrIpAddr.10.166.28.6.0 : 
> IpAddress: 10.166.28.6)

What I think is being displayed here is the table index, defined as:

INDEX { ospfNbrIpAddr, ospfNbrAddressLessIndex }

It so happens that the first interface is numbered, so 
ospfNbrAddressLessIndex will be 0 as specified in the MIB:

     ospfNbrAddressLessIndex OBJECT-TYPE
         SYNTAX   InterfaceIndex
         MAX-ACCESS   read-only
         STATUS   current
         DESCRIPTION
            "On an interface having an  IP  Address,  zero.
            On  addressless  interfaces,  the corresponding
            value of ifIndex in the Internet Standard  MIB.
            On  row  creation, this can be derived from the
            instance."

> 
> 2.  In the other two polls, the IP in the poll is 0.0.0.0, but the 
> instances match the ifTable, yet the information returned is also 
> 0.0.0.0...would that be expected??
> 
> (ex. ospf.ospfNbrTable.ospfNbrEntry.ospfNbrIpAddr.0.0.0.0.21 : 
> IpAddress: 0.0.0.0
>       ospf.ospfNbrTable.ospfNbrEntry.ospfNbrIpAddr.0.0.0.0.23 : 
> IpAddress: 0.0.0.0)

I agree this looks fishy. If I had to guess, I'd say the code in 
this area was never updated when we moved from rfc 1253 to rfc 
1850.  In the older version of the MIB the definition was:

      ospfNbrIpAddr OBJECT-TYPE
          SYNTAX   IpAddress
          ACCESS   read-write
          STATUS   mandatory
          DESCRIPTION
             "The IP address of this neighbor."
          ::= { ospfNbrEntry 1 }

So, for unnumbered interfaces this is returned as 0.0.0.0.

Feel free to file a bug against ospf for this.

Regards,
Paul

> 
>  
> 
> I guess I'm not understanding what should be polled and returned as 
> compared to what they are actually seeing here.
> 
>  
> 
> Files:
> 
> Show Tech:  
> http://wwwin-tools.cisco.com/casekwery/getAttachment?id=30975569&download=Y 
> <http://wwwin-tools.cisco.com/casekwery/getAttachment?id=30975569&download=Y>
> 
> IfTable walk: 
> http://wwwin-tools.cisco.com/casekwery/getAttachment?id=30975562&download=Y 
> <http://wwwin-tools.cisco.com/casekwery/getAttachment?id=30975562&download=Y>
> 
> Word Doc with some additional data: 
> http://wwwin-tools.cisco.com/casekwery/getAttachment?id=30942401&download=Y 
> <http://wwwin-tools.cisco.com/casekwery/getAttachment?id=30942401&download=Y> 
> 
> 
>  
> 
> Thanks in advance for your help.
> 
>  
> 
> -Joe
>