[HECnet] Thousands of DECnet errors on Tops-20

[Thomas DeBellis]

OK, I guess that's probably a level 2 router broadcast coming over the 
bridge.  There is no way Tops-10 or Tops-20 could currently be 
generating that because there is no code to do so; they're level 1, only

I started looking at the error; it starts out in DNADLL when it is 
detected on a frame that has come back from NISRV (the Ethernet 
Interface driver).  The error is then handed off to NTMAN where the 
actual logging is done.  So, there are two quick hacks to stop all the 
errors:

 1. I could stub out the length error entry (XWD UNLER%,^D5) in the
    NIEVTB: table in DNADLL.MAC.
 2. I could put in a filter ($NOFIL) for event class 5 in the NMXFIL:
    table in NTMAN.MAC.

That will stop the deluge for the moment.  Meanwhile, I have to 
understand what's actually being detected; even the full SPEAR entry is 
short on details (like how long the frame was).

36 bitters!  If any of you could check your ERROR.SYS files, you could 
be saving yourself from an eventual structure full crash or maybe you 
might be providing some additional to me to help chase this.  I'd be 
particularly interested in knowing if the problem is unique to KLH10 or not.
>
> ------------------------------------------------------------------------
>
> On 1/11/21 3:13 PM, Rob Jarratt wrote:
>
>
> AB 00 00 03 00 00 is the All Routers address. It is likely a router 
> sending a Hello message advertising its presence, presumably coming 
> from node 63.779.
>
> Regards
>
> Rob
>
> *From:*owner-hecnet at Update.UU.SE <owner-hecnet at Update.UU.SE> *On 
> Behalf Of *Thomas DeBellis
> *Sent:* 11 January 2021 19:33
> *To:* HECnet <hecnet at Update.UU.SE>
> *Subject:* [HECnet] Thousands of DECnet errors on Tops-20
>
> I was wondering if anybody else had either seen the below or noticed 
> it.  I didn't have as free space on my public structure as I thought I 
> should, so I went poking around and found:
>
>        TOMMYT:<SYSTEM-ERROR>   Pages Bytes(Size)  Write Date and Time
>     Writer
>
>      ERROR.SYS.1;P777752      138,495 70909216(36) 11-Jan-2021
>     14:20:29 OPERATOR
>
> To put this into perspective, we are looking at about a 304 MB file; 
> it's larger than what could have been held on an RP06  So I ran SPEAR 
> and pulled down a few of the most recent items, viz:
>
>     ***********************************************
>     DECNET ENTRY
>      LOGGED ON  9-Jan-2021 19:02:18-EST      MONITOR UPTIME WAS 113
>     day(s) 0:50:12
>             DETECTED ON SYSTEM # 3691.
>             RECORD SEQUENCE NUMBER: 28063.
>     ***********************************************
>     DECNET Event type 5.15, Receive failed
>     From node 2.522 (VENTI2), occurred 9-JAN-2021 19:02:08
>
>       Line NI-0-0
>
>       Failure reason = Frame too long
>       Ethernet header = AB 00 00 03 00 00 / AA 00 04 00 FF 0B
>
> There are hundreds of thousands of these, causing ERROR.SYS to grow by 
> a number of pages every day.  I didn't remember how to turn a DECnet 
> node number into dotted decimal, but I did notice the follow from the 
> DECnet bridge (SIGUSR1):
>
>     Host table:
>     0: purgatorio 0.0.0.0:0 (Rx: 2963632 (3352330) Tx: 1687334 Fw:
>     1276298 (Drop rx: 2076032)) Active: 1 Throttle: 598 (203)
>     1: legato 108.65.195.50:4711 [Ov: 0, Nov: 1693548, Lst: 0] (Rx:
>     1687334 (1693548) Tx: 1276298 Fw: 1687334 (Drop rx: 6214)) Active:
>     1 Throttle: 9054(070)
>     Hash of known destinations:
>     aa000400080a -> 0 (2.520)
>     aa0004000a0a -> 0 (2.522)
>     aa000400ff0b -> 1 (2.1023)
>
> So one of these is coming over that bridge (2.1023).  What is AB 00 00 
> 03 00 00? Anybody have any ideas of what's going on?  I haven't looked 
> in the monitor code, yet.  If you are running any 36 bit OS, what are 
> you seeing?
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.sonic.net/pipermail/hecnet-list/attachments/20210111/1a518394/attachment-0001.htm>