<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>OK, I guess that's probably a level 2 router broadcast coming
over the bridge. There is no way Tops-10 or Tops-20 could
currently be generating that because there is no code to do so;
they're level 1, only</p>
<p>I started looking at the error; it starts out in DNADLL when it
is detected on a frame that has come back from NISRV (the Ethernet
Interface driver). The error is then handed off to NTMAN where
the actual logging is done. So, there are two quick hacks to stop
all the errors:</p>
<ol>
<li>I could stub out the length error entry (<font size="+1"><tt>XWD
UNLER%,^D5</tt></font>) in the <font size="+1"><tt>NIEVTB:</tt></font>
table in DNADLL.MAC.</li>
<li>I could put in a filter (<font size="+1"><tt>$NOFIL</tt></font>)
for event class 5 in the <font size="+1"><tt>NMXFIL:</tt></font>
table in NTMAN.MAC.<br>
</li>
</ol>
<div class="moz-cite-prefix">
<p>That will stop the deluge for the moment. Meanwhile, I have to
understand what's actually being detected; even the full SPEAR
entry is short on details (like how long the frame was).<br>
</p>
</div>
<div class="moz-cite-prefix">36 bitters! If any of you could check
your ERROR.SYS files, you could be saving yourself from an
eventual structure full crash or maybe you might be providing some
additional to me to help chase this. I'd be particularly
interested in knowing if the problem is unique to KLH10 or not.<br>
</div>
<blockquote type="cite"
cite="mid:018a01d6e856$5291d9d0$f7b58d70$@ntlworld.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style>@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}tt
{mso-style-priority:99;
font-family:"Courier New";}span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}div.WordSection1
{page:WordSection1;}</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><span
style="mso-fareast-language:EN-US"></span></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"></span></p>
<hr width="100%" size="2">
<p class="MsoNormal">On 1/11/21 3:13 PM, Rob Jarratt wrote:<br>
<span style="mso-fareast-language:EN-US"></span></p>
<p class="MsoNormal"><br>
<span style="mso-fareast-language:EN-US"></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">AB
00 00 03 00 00 is the All Routers address. It is likely a
router sending a Hello message advertising its presence,
presumably coming from node 63.779.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Rob<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm
0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1
1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span
lang="EN-US"> <a class="moz-txt-link-abbreviated" href="mailto:owner-hecnet@Update.UU.SE">owner-hecnet@Update.UU.SE</a>
<a class="moz-txt-link-rfc2396E" href="mailto:owner-hecnet@Update.UU.SE"><owner-hecnet@Update.UU.SE></a> <b>On Behalf Of </b>Thomas
DeBellis<br>
<b>Sent:</b> 11 January 2021 19:33<br>
<b>To:</b> HECnet <a class="moz-txt-link-rfc2396E" href="mailto:hecnet@Update.UU.SE"><hecnet@Update.UU.SE></a><br>
<b>Subject:</b> [HECnet] Thousands of DECnet errors on
Tops-20<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p>I was wondering if anybody else had either seen the below
or noticed it. I didn't have as free space on my public
structure as I thought I should, so I went poking around and
found:<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p><span style="font-size:13.5pt;font-family:"Courier
New""> TOMMYT:<SYSTEM-ERROR> Pages
Bytes(Size) Write Date and Time Writer <br>
<br>
ERROR.SYS.1;P777752 138,495 70909216(36)
11-Jan-2021 14:20:29 OPERATOR </span><o:p></o:p></p>
</blockquote>
<p>To put this into perspective, we are looking at about a 304
MB file; it's larger than what could have been held on an
RP06 So I ran SPEAR and pulled down a few of the most
recent items, viz:<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p><tt><span style="font-size:10.0pt">***********************************************</span></tt><span
style="font-size:10.0pt;font-family:"Courier
New""><br>
<tt>DECNET ENTRY</tt><br>
<tt> LOGGED ON 9-Jan-2021 19:02:18-EST MONITOR
UPTIME WAS 113 day(s) 0:50:12</tt><br>
<tt> DETECTED ON SYSTEM # 3691.</tt><br>
<tt> RECORD SEQUENCE NUMBER: 28063.</tt><br>
<tt>***********************************************</tt><br>
<tt>DECNET Event type 5.15, Receive failed</tt><br>
<tt>From node 2.522 (VENTI2), occurred 9-JAN-2021
19:02:08</tt><br>
<br>
<tt> Line NI-0-0</tt><br>
<br>
<tt> Failure reason = Frame too long</tt><br>
<tt> Ethernet header = AB 00 00 03 00 00 / AA 00 04 00
FF 0B</tt></span><o:p></o:p></p>
</blockquote>
<p>There are hundreds of thousands of these, causing ERROR.SYS
to grow by a number of pages every day. I didn't remember
how to turn a DECnet node number into dotted decimal, but I
did notice the follow from the DECnet bridge (SIGUSR1):<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p><tt><span style="font-size:10.0pt">Host table:</span></tt><span
style="font-size:10.0pt;font-family:"Courier
New""><br>
<tt>0: purgatorio 0.0.0.0:0 (Rx: 2963632 (3352330) Tx:
1687334 Fw: 1276298 (Drop rx: 2076032)) Active: 1
Throttle: 598 (203)</tt><br>
<tt>1: legato 108.65.195.50:4711 [Ov: 0, Nov: 1693548,
Lst: 0] (Rx: 1687334 (1693548) Tx: 1276298 Fw: 1687334
(Drop rx: 6214)) Active: 1 Throttle: 9054(070)</tt><br>
<tt>Hash of known destinations:</tt><br>
<tt>aa000400080a -> 0 (2.520)</tt><br>
<tt>aa0004000a0a -> 0 (2.522)</tt><br>
<tt>aa000400ff0b -> 1 (2.1023)</tt></span><o:p></o:p></p>
</blockquote>
<p>So one of these is coming over that bridge (2.1023). What
is <tt><span style="font-size:10.0pt">AB 00 00 03 00 00</span></tt>?
Anybody have any ideas of what's going on? I haven't looked
in the monitor code, yet. If you are running any 36 bit OS,
what are you seeing?<o:p></o:p></p>
</div>
</div>
</blockquote>
</body>
</html>