GK through IMA

GK Messages
GLCFR Messages
GRIP Messages
GRP Messages
GRPGE Messages
GRPPOS Messages
GRP_OC12_CH_DS3 Messages
GSRIPC Messages
GSR_ENV Messages
GT64010 Messages
HAWKEYE Messages
HD Messages
HDV Messages
HMM_ASYNC Messages
HOOD Messages
HP100VG Messages
HTSP Messages
HUB Messages
IBM2692 Messages
IDMGR Messages
IDS Messages
IDTATM25 Messages
IFS Messages
IGRP Messages
ILACC Messages
IMA Messages

GK Messages

The following are GK- H.323 Gatekeeper error messages

Error Message

%GK-3-CONFLICTING_DATA

Explanation The static-alias command has failed. The endpoint already exists.

Recommended Action Use the show gatekeeper endpoints command to check on existing endpoints. If the message recurs, copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%GK-3-ENDPT_NOT_FOUND

Explanation The endpoint was not found for the specified IP address.

Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%GK-3-EXCEED_MAX_LOCAL_ZONE_ALLOWED

Explanation The maximum number of local zones allowed has been exceeded.

Error Message

%GK-3-GW_PROXY_ADD_COST_FAIL

Explanation The GW/PROXY add cost has failed. The system could be out of memory.

Error Message

%GK-3-GW_PROXY_ALIAS_NOT_FOUND

Explanation The GW/PROXY was not found for the specified alias name.

Error Message

%GK-3-GW_PROXY_ENDPT_NOT_FOUND

Explanation An add cost has failed. The GW/PROXY may not be registered.

Error Message

%GK-3-GW_PROXY_IP_NOT_FOUND

Explanation The GW/PROXY was not found for the specified IP address.

Error Message

%GK-3-INVALID_GK_CMD

Explanation An invalid command was used to shut down the Gatekeeper.

Recommended Action To shutdown the Gatekeeper, use the shutdown command in the Gatekeeper mode. If this message recurs, copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%GK-3-NO_DISC_PORT

Explanation The system is unable to open or bind to the Gatekeeper discovery port, and the bringup process has failed.

Error Message

%GK-3-NO_RAS_PORT

Explanation The system is unable to open or bind to the RAS well-known port, and the bringup process has failed.

Error Message

%GK-3-PARTIAL_STATIC_ALIAS:

Explanation Not all aliases were successfully created.

Recommended Action Use the show gatekeeper endpoints command to confirm the successful aliases.

Error Message

%GK-3-PROC_CB_NOMEM

Explanation No memory was available for the process control block. The Gatekeeper bringup process has failed.

Error Message

%GK-3-PROC_EV_NOMEM

Explanation No memory is available for the free event queue. The Gatekeeper bringup process has failed.

Error Message

%GK-3-PROC_NOCREAT:

Explanation No memory is available to create the Gatekeeper process. The Gatekeeper bringup process has failed.

Error Message

%GK-4-PROC_NOTALL:

Explanation The system could not create more than the specified number of Gatekeeper thread processes.

Error Message

%GK-3-PROC_NOTDOWN:

Explanation This message reports an invalid state. The bringup process will be permitted only after a shutdown is performed.

Error Message

%GK-3-PROC_NOTUP:

Explanation This message reports an invalid state. The bringup process will be permitted only after a shutdown is performed.

Error Message

%GK-3-SHUTDOWN_WITH_CALLS:

Explanation The Gatekeeper shutdown will not take place because there are calls in progress.

Error Message

%GK-3-STATIC_ALIAS_FAILED:

Explanation The alias static command has failed and an endpoint could not be created in the endpoint database.

Error Message

%GK-3-STATIC_ALIAS_GW_FAILED:

Explanation A static endpoint was added into the database, but it failed to create a gateway.

Error Message

%GK-3-SUBNET_FAILED:

Explanation The subnet information for the specified subnet could not be created.

Error Message

%GK-3-SUBNET_NOT_FOUND:

Explanation The subnet was not found under the specified IP address.

Error Message

%GK-3-SUBNET_NO_ATTRIBUTES:

Explanation No attribute was specified for the [default | explicit] command.

Recommended Action If an attribute was specified, and this error message was generated. Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%GK-3-ZONE_ACTIVE:

Explanation There are endpoints currently registered in the specified zone; therefore the zone could not be removed.

Error Message

%GK-3-ZONE_NOT_FOUND:

Explanation The zone was not found for the specified Gatekeeper name.

GLCFR Messages

The following are Gigabit Switch Router (GSR) error messages.

Error Message

%GLCFR-3-DLCIRANGE: [chars]([chars]) bad dlci value [int]

Explanation The GLC Frame Relay support code has received an invalid data-link connection identifier (DLCI) number.

GRIP Messages

The following are Xerox Network Systems (XNS) Routing Protocol error messages.

Error Message

%GRIP-3-BADPATHS: Invalid number of paths ([dec]) for %q

Explanation An internal inconsistency was detected in the Xerox Network Systems (XNS) routing table structure.

Recommended Action Note the parameters associated with this message and call your Cisco technical support representative for assistance.

Error Message

%GRIP-2-BADROUTE: Error [chars] route - null table

Explanation A hardware or software error has occurred.

GRP Messages

The following are gigabit route processor error messages.

Error Message

%GRP-3-ADDRERROR: Bad access to fabric-buffers : invalid address

Explanation An illegal access has been made to the fabric buffers. This problem usually indicates a software error.

Error Message

%GRP-4-BAD_PKT: CSAR: Received slot [int] Chan [int]

Explanation An invalid packet was received at CSAR.

Error Message

%GRP-4-BADLENGTH: Internal fabric register mismatch. Expected length = [int]. Received length = [int].

Explanation A packet has been received from the fabric, but the packet length received and the packet length indicated in the buffer header do not match.

Error Message

%GRP-3-BADSTATE: Reassembly state is bad for slot [int]. State = [int]

Explanation The software is in an incorrect state for receiving the current packet over the fabric. The message reports the slot in which the packet was received and describes the state of the reassembly.

Error Message

%GRP-3-BAD_RESET:

Explanation The software attempted to reset itself over the maintenance bus (MBus).

Error Message

%GRP-3-BAD_STATE: Slot:[int] State:[chars]

Explanation An attempt was made to send a message to a card that was in an incorrect state. The card and state are shown in the error message.

Error Message

%GRP-3-BMAUCODE_ALLOC: Failed buffer allocation for [chars]

Explanation A data structure could not be allocated to contain the contents of the given BMA microcode file. There may be insufficient DRAM.

Error Message

%GRP-3-BMAUCODE_BAD: Slot [dec]: bad slot state ([dec]) or card type ([hex] - [chars])

Explanation The software is not able to select or download the given BMA microcode on the given slot. Either the line card is not present, there is a card type other than a line card in the given slot, or the line card is not enabled.

Error Message

%GRP-3-BMAUCODE_ENABL: No line cards enabled: selector [chars], feature [chars]

Explanation The selection or download of the BMA microcode failed for all slots, selector, and feature. There are no enabled line cards.

Error Message

%GRP-3-BMAUCODE_FAIL: Slot [dec], selector [chars], feature [chars]

Explanation The selection or download of the BMA microcode has failed for the given slot, selector, and feature. The line card could be disabled, or there could have been an error on the line card during the attempt to select or download the BMA microcode.

Error Message

%GRP-3-BMAUCODE_FILE: Error reading [chars]

Explanation The given binary BMA microcode could not be read, probably because it was not found.

Error Message

%GRP-3-BMAUCODE_SELECTOR: Command selector [chars] != file header selector [chars]

Explanation For the bma microcode download command, the selector specified on the command line does not match the selector in the binary BMA microcode file.

Error Message

%GRP-4-CAMFULL: Too many entries in the Ethernet CAM

Explanation Too many Media Access Control (MAC) addresses were put into the content addressable memory (CAM) of the Ethernet. This problem usually indicates a software error.

Error Message

%GRP-3-CARVE_ADD: Failed to add buffer size [unsigned long] with delta [int]

Explanation The specified buffer size could not be added to the SDRAM buffer carve specification because of one of the following internal parameter errors: an exceeded number of available elements, an excessive delta size, or null parameters.

Error Message

%GRP-3-CARVE_FAIL: [chars] BMA, slot [int]

Explanation One of the following problems has occurred: the SDRAM buffer carve on the given line card failed, the route processor (RP) failed to send the carve information to the line card through IPCs, or the carve result from the line card failed to return to the RP. The line card probably is disabled.

Recommended Action Try rebooting the line card. If rebooting the line card does not resolve the problem, consider power-cycling the router. If the message recurs, copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%GRP-3-CARVE_FREEQS: Free queues ([int]) > allowed ([int])

Explanation The number of free queues allowed for the SDRAM buffer carving has been exceeded.

Error Message

%GRP-4-CARVE_MTU: Only [int] MTUs considered (max = [dec])

Explanation The list of different maximum transmission unit (MTUs) that can be considered in the SDRAM buffer carving is limited by the given maximum number.

Error Message

%GRP-3-CARVE_PCT: Sum percentage SDRAM buffers ([int]) > 100

Explanation The specified sum of percentages for SDRAM buffer sizes has exceeded 100.

Error Message

%GRP-3-CARVE_SIZE: SDRAM buffer size [unsigned long] < its delta [unsigned long]

Explanation The rounded-up SDRAM buffer size should be larger than the specified size.

Error Message

%GRP-3-CARVE_SPEC: Empty SDRAM buffer carve specification

Explanation There is no SDRAM buffer carve specification to send to a line card.

Error Message

%GRP-3-CARVE_ZERO: [chars] BMA, slot [int], entry index [int]: zero SDRAM buffer size

Explanation The given SDRAM buffer size should not be zero.

Error Message

%GRP-4-CELLNEG: Detected an internal signal error on the fabric interface

Explanation An internal signal between the CSAR and the Fabric Interface ASIC (FIA) was deasserted too early.

Error Message

%GRP-4-COOKIE: Corrupt or missing MAC address cookie -- using random base [sci_notation]

Explanation The part containing the Media Access Control (MAC) addresses allocated to this chassis could not be accessed or was found to be corrupt, either because of a hardware problem or because of a manufacturing problem.

Error Message

%GRP-4-CORRUPT: Corrupted packet received. start_offset = [int] length = [int] card = [int]

Explanation A buffer having a corrupted buffer header has been received from the fabric.

Error Message

%GRP-4-CRC32: CRC32 error detected from slot [int]

Explanation A CRC32 error has been detected.

Error Message

%GRP-3-ERROR: NULL

Explanation This message provides information about a software error.

Error Message

%GRP-4-ETHERPAL: Ethernet PAL on the GRP is missing

Explanation The system software has detected that the Ethernet PAL on the gigabit route processor (GRP) either is missing or is improperly installed.

Error Message

%GRP-3-EXEC_ALLOC: No memory for command

Explanation No memory was available to allocate for the remote command string.

Error Message

%GRP-3-EXEC_ENABL: No line cards enabled

Explanation There are no enabled line cards.

Error Message

%GRP-3-EXEC_SLOT: Slot [dec] not enabled

Explanation There is no card in the given slot, or the card exists but is not enabled.

Error Message

%GRP-3-FABCOPY: [chars] address = 0x[hex]

Explanation The fabric driver software has passed an incorrectly aligned pointer.

Error Message

%GRP-3-FABRIC: [chars] ([int])

Explanation The master route processor (RP) is unable to communicate over the fabric to the specified line card.

Error Message

%GRP-3-FABRIC_MULTI: [chars] ([hex])

Explanation A problem has been detected between the master route processor (RP) and a line card over the fabric.

Error Message

%GRP-3-FABRIC_UNEXP: [chars] ([int])

Explanation An unexpected message has been received from the specified line card.

Error Message

%GRP-3-FABRIC_UNI: [chars] ([int])

Explanation A problem has been detected over the fabric between the master route processor (RP) and a line card.

Error Message

%GRP-4-FIRSTLAST: First/Last cell error detected from slot [int]

Explanation A cell has been received with an invalid first or last bit set.

Error Message

%GRP-4-FROMFABPAR: Parity error detected in from fabric buffer memory. Slot [int]

Explanation A parity error from the fabric buffers has been detected.

Error Message

%GRP-3-IFCON: Too many Queued messages, No buffers available

Explanation Too many messages are coming from the GSR line card. There are no more buffers on the Route Processor (RP) to handle these messages.

Recommended Action Try shutting down debugging messages on the line card or reloading it. Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%GRP-3-LC_CARD_TYPE_INVALID: Linecard has invalid card type [hex]

Explanation The line card type is invalid. The line card EEPROM is programmed with an invalid card type.

Error Message

%GRP-3-LC_FLASH_PROG_FAIL: Slot [dec] failed program flash with [chars]

Explanation The line card could not be programmed and may be defective.

Error Message

%GRP-3-LC_POST_ALLOC: Failed buffer allocation for [chars]

Explanation A data structure could not be allocated to contain contents of the given line card POST file. There may be insufficient DRAM.

Error Message

%GRP-3-LC_POST_FAIL: Slot [dec] fail download

Explanation The download of the GLC POST has failed for the given slot. The line card could be disabled, or an error could have occurred on the line card during the attempt to download the GLC POST.

Error Message

%GRP-3-LDFAIL: Unable to download ucode from [chars] in slot [hex] (bitmask), trying [chars] ucode

Explanation For some reason, the line card image specified by the configuration is not suitable for downloading, or another error has occurred. The line card image that is bundled within the gigabit route processor (GRP) system image will be loaded.

Recommended Action Try reloading the microcode. If the message recurs, copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%GRP-3-MEMSIZE: Non oct-byte access to fabric buffers

Explanation An illegal access has been made to the fabric buffers. This message usually indicates a software error.

Error Message

%GRP-3-MODULE: Missing [chars] for [chars]

Explanation A hardware or software error has occurred.

Error Message

%GRP-3-MSGTOOBIG: Datagram size too large ([int])

Explanation An attempt to send a packet over the fabric has failed because the packet was too big. This problem usually indicates a software error.

Error Message

%GRP-3-NOFILE: Ucode file [chars] not found, system ucode loaded in slot [hex] (bitmask)

Explanation The file specified by the configuration was not found in flash memory. The slot number represents a bit mask of the cards affected. The line card image that is bundled within the gigabit route processor (GRP) system image will be loaded.

Recommended Action Use the show flash command to determine if the file is located in flash memory. If the file is located, attempt to reload the microcode. If the message recurs, copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%GRP-3-NOMAC: Can't allocate MAC address for interface [int]/[int]

Explanation No Media Access Control (MAC) address was available for allocation to the specified interface.

Error Message

%GRP-4-NO_INTF: CSAR: No interface available Slot [int] Chan [int]

Explanation The CSAR has received a packet with an invalid interface.

Error Message

%GRP-4-OLDVERSION: Running old version of GRP

Explanation The system software has detected an old version of the gigabit route processor (GRP).

Recommended Action The GRP must be upgraded in order to run with this software.

Error Message

%GRP-3-PARITYERR: Parity error detected in the fabric buffers. Data ([hex])

Explanation A parity error has been detected by the fabric interface hardware on the Route Processor (RP). The hex number indicates the error interrupt vector. This message usually indicates a hardware problem on the RP.

Error Message

%GRP-3-POST_CODE_FILE: Error reading [chars], post.ucode is required in slot0 for upgrade

Explanation The software could not read the given binary LC POST code, possibly because it has not found the post.ucode in the PCMCIA card.

Error Message

%GRP-3-QFULLPAR: Parity error detected

Explanation A parity error was detected between the CSAR and the Fabric Interface ASIC (FIA) on the "queue full" signals. The parity error usually indicates a hardware error.

Error Message

%GRP-4-Q_CORRUPT: CSAR: HoldQ Count is corrupted

Explanation The CSAR Queue indicates a packet even though none is available.

Error Message

%GRP-4-REASSEMBLY: Reassembly error detected. Slot = [int]. State = [int], Status = [int]

Explanation There has been an error in reassembling a buffer over the fabric. The message indicates the slot in which the errored packet was received and describes the state of the reassembly. The status of the packet can be decoded as follows: 00 = middle buffer, 01 = last buffer, 10 = first buffer, 11 = only buffer.

Error Message

%GRP-3-RESET_CARD: Card [int] has reset too many times.

Explanation The line card specified in the error message has automatically reset itself too many times in attempts to overcome an error condition. It will attempt a reload again after ten minutes have elapsed. This probably indicates that the card is either incorrectly installed, incorrectly configured, or experiencing a hardware failure.

Recommended Action Check the configuration and cabling for errors. The line card can be reloaded manually using the microcode reload command. If the message recurs, copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%GRP-3-RESTART: NULL

Explanation The SDRAM buffer memory was reset and reallocated. If this message did not appear as result of using an operator-issued command (for example, after the maximum transmission unit (MTU) was changed on an interface), then it may indicate an internal software error.

Error Message

%GRP-4-RXFAB: From fabric buffers are out of order with software. Index = [int], Expected = [int], Received = [int]

Explanation The fabric driver software is not synchronized with the fabric hardware.

Error Message

%GRP-4-SEQUENCE: Sequence error detected from slot [int]. Expected [int]

Explanation A cell with an incorrect sequence number has been received.

Error Message

%GRP-3-TYPE: Unknown link type [int] int [int]/[int]

Explanation A packet was received on an interface that had an unknown link type. This message most likely indicates that there is a software problem.

Error Message

%GRP-3-UCODEFAIL: [chars] [int]

Explanation The image that was downloaded to the line card has been rejected by the line card.

Error Message

%GRP-3-UCODETIMEOUT: [chars] ([int])

Explanation The line card did not acknowledge the download of the image.

Recommended Action Try reloading the line card image. If the message recurs, copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%GRP-3-UNDEF_HDR: Slot [int]:[hex] [hex] [hex] [hex] [hex] [hex] [hex] [hex]

Explanation A packet has been received from the fabric, but there was a problem in the header. The data that appear are the first bytes from the buffer header and the payload.

Error Message

%GRP-4-UNEXPBUFFER: Unexpected buffer finished sending to fabric ([int])

Explanation A send to fabric buffer completed sending, however, the software was not expecting this buffer to be completed.

Error Message

%GRP-3-UNEXPINT: [chars] [hex]

Explanation An unexpected interrupt has occurred from the specified device on the gigabit route processor (GRP).

Recommended Action Copy the error message exactly as it appears on the console or in the system log. Issue the show tech-support command to gather data that may provide information to determine the nature of the error. If you cannot determine the nature of the error from the error message text or from the show tech-support command output, call your Cisco technical support representative, and provide the representative with the gathered information.

GRPGE Messages

The following are Gigabit Ethernet route processor (RP) driver error messages.

Error Message

%GRPGE-3-CMDERR: Interface ([chars]): [chars] IPC command fails (cause: 0x[hex])

Explanation The Gigabit Ethernet route processor (RP) driver has experienced an interprocess communication (IPC) command error.

Error Message

%GRPGE-3-EVENT: Interface ([chars]): unknown IPC event ([int]) from linecard

Explanation The Gigabit Ethernet route processor (RP) driver has received an unknown event from the line card.

Error Message

%GRPGE-3-INIT: Gigabit Ethernet driver ([int]/[int]) initialization [chars]

Explanation The Gigabit Ethernet route processor (RP) driver has experienced a software initialization error.

Error Message

%GRPGE-3-OP: Interface ([chars]): [chars]

Explanation The Gigabit Ethernet route processor (RP) driver has received an unexpected event.

Recommended Action Copy the error message exactly as it appears on the console or in the system log. Issue the show gsr, and show ipc status commands to gather data that may provide information to determine the nature of the error. If you cannot determine the nature of the error from the error message text or from the show gsr, or show ipc status command output, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%GRPGE-4-MSGVERSION: Incompatible message version with slot [dec]

Explanation The message version being sent by the line card does not match the message version used by the gigabit route processor (GRP). This type of incompatibility can happen if the GRP and the line card are using different Cisco IOS versions, and a GRP online insertion and removal (OIR) event. The only problem caused by this condition is that POS statistics are not being reported to the GRP.

Recommended Action To resolve the problem reload the microcode.

Error Message

%GRPGE-4-NULLCEFIDB: Interface ([chars])

Explanation This interface does not have a Cisco express forwarding (CEF) interface descriptor block (IDB) by mistake.

Error Message

%GRPGE-6-SH_CAM_FULL: Failed to add address [sci_notation] to full [dec] entry shadow CAM

Explanation An attempt to add an entry to the content addressable memory (CAM) Media Access Control (MAC) address filter then failed.

Recommended Action Copy the error message exactly as it appears on the console or in the system log. If you cannot determine the nature of the error from the error message text, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%GRPGE-4-UNSUP: Interface ([chars]): unsupported feature: [chars]

Explanation This feature is not supported by Gigabit Ethernet route processor (RP).

GRPPOS Messages

The following are POS route processor error messages.

Error Message

%GRPPOS-4-MSGVERSION: Incompatible message version with slot [dec]

Explanation The message version being sent by the line card does not match the message version being used by the gigabit route processor (GRP). This type of incompatibility could happen if the GRP and line card are using different Cisco IOS versions as a result of a GRP online insertion and removal (OIR) event.The only problem caused by this condition is that POS statistics are not being reported to the GRP.

Recommended Action To resolve the problem, reload the microcode.

Error Message

%GRPPOS-3-OP: Interface ([chars]): [chars]

Explanation The POS route processor (RP) driver has received an unexpected event.

Recommended Action Copy the error message exactly as it appears on the console or in the system log. Issue the show gsr and show ipc status commands to gather data that may provide information to determine the nature of the error. If you cannot determine the nature of the error from the error message text or from the show gsr and show ipc status command output, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%GRPPOS-3-TIMEOUT: Interface ([chars]): [chars]

Explanation The POS route processor (RP) driver queried the line card for SONET information, but the line card did not reply.

Recommended Action Copy the error message exactly as it appears on the console or in the system log. Issue the show gsr, show ipc nodes, show ipc ports, and show ipc status commands to gather data that may provide information to determine the nature of the error. If you cannot determine the nature of the error from the error message text or from the show gsr, show ipc nodes, show ipc ports, and show ipc status command output, call your Cisco technical support representative, and provide the representative with the gathered information.

GRP_OC12_CH_DS3 Messages

The following are Gigabit Route Processor (GRP) driver error messages.

Error Message

%GRP_OC12_CH_DS3-1-ALLOCFAIL: OC12 [dec]/[dec][chars] allocation failure

Explanation An OC12-channelized-to-DS3 controller or a channel memory allocation failure has occurred.

Error Message

%GRP_OC12_CH_DS3-5-BERT: Interface [chars], BERT [chars]

Explanation The OC12-CH-DS3 driver has received and processed a bit error rate tester (BERT) completion event.

Recommended Action This message appears whenever the notification for a BERT completion event is received. No action is required.

Error Message

%GRP_OC12_CH_DS3-3-CORRUPT: Corrupt configuration, unsupported [chars] ([int]) encountered

Explanation The OC12-CH-DS3 route processor (RP) driver running configuration is corrupt.

Recommended Action Copy the error message exactly as it appears on the console or in the system log. Issue the show gsr, and show ipc status commands to gather data that may provide information to determine the nature of the error. If you cannot determine the nature of the error from the error message text or from the show gsr or show ipc status command output, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%GRP_OC12_CH_DS3-5-FAREND: Interface [chars] [chars] far end request of type ([chars])

Explanation The OC12-CH-DS3 driver has received and processed a known far-end request.

Recommended Action No action is required.

Error Message

%GRP_OC12_CH_DS3-1-MIA: OC12 [dec]/[dec] LC removed during initialization

Explanation An OC12-channelized-to-DS3 line card (LC) was removed during the initialization.

Recommended Action If OC12-channelized-to-DS3 functionality is desired, replace the LC.

Error Message

%GRP_OC12_CH_DS3-4-MSGVERSION: Incompatible message version with slot [dec]

Explanation The message version being sent by the line card does not match the message version being used by the gigabit route processor (GRP). This type of incompatibility can happen if the GRP and the line card are using different Cisco IOS software versions as a result of a GRP online insertion and removal (OIR) event.The only problem caused by this condition is that POS statistics are not being reported to the GRP.

Recommended Action To resolve the problem, reload the microcode.

Error Message

%GRP_OC12_CH_DS3-3-OP: Interface ([chars]): [chars]

Explanation The OC12-CH-DS3 route processor (RP) driver has received an unexpected event.

Recommended Action Copy the error message exactly as it appears on the console or in the system log. Issue the show gsr and show ipc status commands to gather data that may provide information to determine the nature of the error. If you cannot determine the nature of the error from the error message text or from the show gsr or show ipc status command output, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%GRP_OC12_CH_DS3-3-TIMEOUT: Interface ([chars]): [chars]

Explanation The OC12-CH-DS3 route processor (RP) driver queried the line card (LC) for SONET information, and the LC did not reply.

Recommended Action Copy the error message exactly as it appears on the console or in the system log. Issue the show gsr, show ipc nodes, show ipc ports and show ipc status commands to gather data that may provide information to determine the nature of the error. If you cannot determine the nature of the error from the error message text or from the show gsr, show ipc nodes, show ipc ports, or show ipc status command output, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%GRP_OC12_CH_DS3-3-UNKNOWN_FAREND: Interface [chars] received an unknown far end request ([int])

Explanation The OC12-CH-DS3 route processor (RP) driver has received an unknown far-end request.

GSRIPC Messages

The following are Gigabit Switch Router interprocess communication (IPC) service routines error messages.

Error Message

%GSRIPC-3-PORT: port ([chars]) already exists

Explanation The port to be created already exists.

Error Message

%GSRIPC-3-REXEC: [chars]

Explanation The remote execution open port has failed.

Error Message

%GSRIPC-3-SYSCALL: For port ([chars]): [chars] fails (cause: [chars])

Explanation The interprocess communication (IPC) kernel system call has failed.

GSR_ENV Messages

The following are Gigabit Switch Router (GSR) environment monitor error messages.

Error Message

%GSR_ENV-1-CRITICAL: Slot [dec] [chars] [dec] [chars] [chars] [dec] [chars]

Explanation The environmental parameters for the specified slot are in the critical range. The card in the slot may be powered down for safety reasons.

Recommended Action This problem must be resolved immediately. Copy the error message exactly as it appears on the console or in the system log. If you cannot determine the nature of the error from the error message text, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%GSR_ENV-1-CRITICAL_FAN: Slot [dec] [chars] [int] [chars]

Explanation One or more fans are broken or missing. This may cause the chassis to overheat.

Recommended Action Replace the defective fan tray.

Error Message

%GSR_ENV-0-POWERDOWN: [chars] in slot [dec]

Explanation The slot has been powered down for safety reasons.

Recommended Action This problem must be resolved before the card is used again. Copy the error message exactly as it appears on the console or in the system log. If you cannot determine the nature of the error from the error message text, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%GSR_ENV-0-SHUTDOWN: Slot [dec] [chars] [dec] [chars] [chars] [dec] [chars]

Explanation The slot may have been powered down for safety reasons. The card will be powered down after three warnings.

Error Message

%GSR_ENV-0-SHUTDOWN_PS: Slot [dec] [chars] [int] [chars]

Explanation The power supply input voltage has failed.

Recommended Action Ensure that the power supply is plugged in and turned on.

Error Message

%GSR_ENV-2-WARNING: Slot [dec] [chars] [dec] [chars] [chars] [dec] [chars]

Explanation The environmental parameters for the specified slot are outside the normal range of operation.

Recommended Action Correct the warning condition specified. For example, for temperature warnings, verify that adequate cooling is available and that the empty slots have blank covers. For voltage warnings, check the appropriate power supply. These warning conditions must be rectified immediately.

GT64010 Messages

The following are GT64010 direct memory access (DMA) controller driver error messages.

Error Message

%GT64010-3-DMA: Interrupt error, c=[hex], m=[hex], rc=[hex]

Explanation An unexpected interrupt that was not initialized by software has been registered from a direct memory access (DMA) engine.

Error Message

%GT64010-1-DMASTALL: DMA interrupt stalled, restarted engine [dec]

Explanation The driver timed out while waiting for the completion of a direct memory access (DMA) task. The DMA engine has been restarted.

Error Message

%GT64010-3-NOCHANNEL: Referencing unused DMA channel [dec]

Explanation Access to an uninitialized direct memory access (DMA) engine was attempted.

Error Message

%GT64010-3-TIMER: Interrupt error, c=[hex], m=[hex], rc=[hex]

Explanation An unexpected timer interrupt was received from a timer element that had not been initialized by software.

Error Message

%GT64010-3-TIMERINSTALL: Attempt to install already installed timer [dec]

Explanation An attempt was made to initialize a timer element that is already in use.

HAWKEYE Messages

The following are Token Ring protocol control information (PCI) port adapter error messages.

Error Message

%HAWKEYE-3-ADPCHK: Interface [chars], adapter check error

Explanation The Token Ring interface encountered an unrecoverable error condition while it was operating and connected to the ring. The interface will automatically shut itself down.

Recommended Action Issue the clear interface token command to restart the interface. If the message recurs, copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%HAWKEYE-1-DISCOVER: Only found [dec] interfaces on bay [dec], shutting down bay

Explanation The Token Ring device driver was unable to communicate with all of the interfaces expected to be on the port adapter module. This could indicate that one or more of the interfaces is not functioning. This message may occur during Cisco IOS software initialization or after a Token Ring port adapter was inserted online.

Recommended Action Reseat the port adapter in the slot. If necessary, install it in another slot. If the message recurs, copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%HAWKEYE-3-INITFAIL: [chars] failed to initialize - [chars]

Explanation The Token Ring interface has encountered an error while attempting to open a connection to the ring. The specific error that occured is described in the last half of the error message as one of the following:

microcode checksum failed---The MAC microcode is corrupted inside the local memory of the interface.
failed to build receive descriptor ring---There was not enough system memory available to allocate receive buffers for packets.
init failed---The interface hardware has rejected the request from the device driver to configure and open the interface.

Recommended Action Reset the interface using the clear interface token command in EXEC mode. If the message recurs, copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%HAWKEYE-3-MAC_CMD_Q_OVERFLOW: HAWKEYE ([dec]/[dec]), MAC command queue overflow

Explanation The command queue of the interface was full when the device driver attempted to send a command to the interface hardware. This message may occur if the device driver software sends commands faster than the interface hardware can process them. This condition is usually not a critical error; the interface should continue to function normally. However, if the error message recurs frequently, it may indicate a more serious problem.

Recommended Action If the error recurs repeatedly, contact your Cisco technical support representative. Otherwise, no action is required.

Error Message

%HAWKEYE-1-NOPCIMEMORY: PCI memory unavailable for [chars]

Explanation The device driver for this interface was unable to allocate the necessary amount of shared memory between the driver and the interface hardware. This condition can occur if the system contains less than the recommended minimum amount of SRAM for the current interface combination. Since shared memory blocks are required for the interface to function, this interface will be inoperable until the memory shortage is corrected.

Error Message

%HAWKEYE-1-OLDREV: HAWKEYE(bay [dec]), Port adapter requires Rev 2 CPU, shutting down bay

Explanation This message is specific to Cisco 7200 series routers. It indicates that the device driver has detected an NPE150 CPU version earlier than Revision 2. The Token Ring device driver requires an NPE150 Revision 2 or later CPU.

Recommended Action Upgrade the Cisco 7200 router processor to an NPE150 Revision 2 or later.

HD Messages

The following are HD64570 serial controller error messages.

Error Message

%HD-1-BADLOOPCABLE: Loopback not supported for a 4T DTE/X.21, port [dec] in slot [dec]

Explanation Loopback mode is not allowed when using an X.21 DTE cable on a Quad serial NIM port.

Recommended Action Do not enable loopback, or use a different cable type.

Error Message

%HD-1-BADPORTADAPTER: 4T Port Adapter fault on port [dec] in slot [dec]

Explanation A hardware or software error has occurred.

Error Message

%HD-1-BADRING: msgtxt_badringsize

Explanation An internal software error has occurred.

Error Message

%HD-5-LINEFLAP: Unit [dec] excessive modem control changes

Explanation Too many modem control interrupts have been received. The port was disabled to prevent excessive use of the CPU.

Recommended Action Check the cable on the serial port.

HDV Messages

The following are High Density Voice (HDV) driver error messages.

Recommended Action

Error Message

%HDV-3-DISCOVER: HDV in slot [dec]: the HDV failed to initialize properly

Explanation An initialization action has failed for the High Density Voice (HDV). This failure could be caused by a lack of system resources, a missing voice interface card (VIC), or an improper type of VIC card installed in the port module, or defective HDV hardware.

Recommended Action Power down. Check that a supported VIC card is properly installed in the HDV port module. Reinsert the VIC card, and then reinsert the port module and reboot the router. If the message recurs, copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%HDV-2-FATAL_ERROR: HDV in slot [dec]: An unrecoverable has occurred

Explanation The High Density Voice (HDV) card has experienced an internal unrecoverable error. This error may be caused by an internal firmware error or defective HDV hardware.

Power down, reinsert the network module, and reboot the router. If the message recurs, copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%HDV-3-FW_START: HDV in slot [dec]: the firmware on the port module did start properly

Explanation The firmware on the card did not start after a reset. This error is usually caused by a defective High Density Voice (HDV) port module or as improperly seated HDV port module.

Recommended Action Power down, reinsert the HDV port module, and reboot the router. If the message recurs, copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%HDV-3-HW_START: HDV in slot [dec]: the port module did not reset and start up properly

Explanation The hardware on the card did not start after a reset. This problem is usually caused by a defective High Density Voice (HDV) port module or an improperly seated HDV port module.

Error Message

%HDV-3-INCORRECT_PMID: HDV in slot [dec]: Incorrect [dec] PM-ID device not supported

Explanation A interface controller device did not have the correct port module ID.

Recommended Action Ensure that the High Density Voice (HDV) port module is inserted properly. If necessary, power down the router and reinsert the HDV port module. If the message recurs, copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%HDV-3-INVALID_PCI_ID: HDV in slot [dec]: reports an invalid device id of [hex]

Explanation The High Density Voice (HDV) port module hardware may be defective or improperly seated.

Recommended Action Power down, reinsert the network module, and reboot. If the message recurs, copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information

Error Message

%HDV-1-NOPCIMEMORY: HDV in slot [dec]: No PCI memory available

Explanation The system is experiencing memory exhaustion in the protocol control information (PCI)/packet memory. This condition is probably caused by heavy traffic congestion, but could also indicate a software error.

Recommended Action Review the configuration for performance bottlenecks. If the message recurs, copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%HDV-1-NO_DAUGHTER_CARD: HDV in slot [dec]: no VIC card is inserted in the HDV

Explanation The software did not detect the presence of a voice interface card (VIC) inserted in the High Density Voice (HDV) port module.

Recommended Action Ensure that the VIC card is inserted properly into the HDV. If it is , then check the part number on the VIC card to verify that is supported by the version of Cisco IOS software running on the router. For further assistance, contact your Cisco technical support representative.

Error Message

%HDV-1-TOOBIG: HDV in slot [dec]: packet size ([dec]) too big

Explanation A packet greater than the 256-byte maximum was received on this interface.

Recommended Action The system should recover. No action is required. If the message recurs, copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%HDV-1-UNKNOWN_VIC: HDV in slot [dec]: VIC daughter card has an unknown id of 0x[hex]

Explanation The software did not recognize the type of voice interface card (VIC) plugged into the High Density Voice (HDV) port module.

Recommended Action Check the part number on the VIC card to verify that is supported by the version of Cisco IOS software running on the router. For further assistance, contact your Cisco technical support representative.

Error Message

%HDV-1-UNSUPPORTED_VIC: HDV in slot [dec]: VIC daughter card ([chars]/0x[hex]) is unsupported

Explanation The type of voice interface card (VIC) plugged into the High Density Voice (HDV) is not supported.

Recommended Action Replace this VIC card with a type that is supported by the Cisco IOS version of software running on the router, or change the version of Cisco IOS software to support this type of VIC card.

HMM_ASYNC Messages

The following are hex modem network module asynchronous driver error messages.

Error Message

%HMM_ASYNC-3-CARD_FAILED_DOWNLOAD: Unable to download firmware image to digital modem card in slot [dec]

Explanation An attempt to bring up the processor on the digital modem card has failed.

Error Message

%HMM_ASYNC-3-HMM_HARDWARE_EXCEPTION: HMM: Digital Modem Card [dec] hardware exception : [chars]

Explanation There may be an intermittent or permanent hardware failure.

Error Message

%HMM_ASYNC-3-MODEM_FAILED_DIAGS: Digital modem [dec]/[dec] on Simm [dec] failed power on diagnostics

Explanation The digital modem has failed to pass the power diagnostics. It will not be used.

Recommended Action If the remaining SIMMs passed the diagnostics, remove or replace the defective SIMM before continuing. Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%HMM_ASYNC-3-MODEM_MAILBOX_IS_FULL: HMM Modem [dec]/[dec] Mailbox is Full, command [hex] not sent

Explanation An error has occurred during an attempt to deliver commands to the modem module. This failure may be a temporary one. If this message repeats every 30 seconds, it may indicate a failed modem module.

Error Message

%HMM_ASYNC-3-MODEM_STOPPED_PROCESSING_MAIL: HMM Modem [dec]/[dec] failed to accept a new command

Explanation The modem has failed to accept a new command. This failure of the modem to accept a new command may be a temporary condition, or the modem may remain unusable until a system reset has been done.

Recommended Action Reset the modem by issuing the clear modem slot | port command. Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%HMM_ASYNC-3-NOMEMORY: No memory for [chars] of unit [dec]

Explanation The router does not have enough memory to perform the function.

Recommended Action Consider adding more shared memory. Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%HMM_ASYNC-3-NORAWRXPOOL: Unable to create pool for [dec] raw Rx mode buffers

Explanation The router does not have enough I/O memory for the buffers.

Error Message

%HMM_ASYNC-3-NORAWTXPOOL: Unable to create pool [dec] raw Tx mode buffers

Explanation The router does not have enough I/O memory for the buffers.

Error Message

%HMM_ASYNC-3-NOTTYCREATE: Unable to create TTY structure for line [dec]

Explanation The router did not have adequate memory to create the tty line control block for the specified line.

Error Message

%HMM_ASYNC-4-NO_MODEMS_PRESENT: HMM Digital Modem Card [dec] contains no active modems

Explanation There are no modems installed on the network module.

Recommended Action Make sure the network module contains properly installed MICA-6DM SIMMs.

Error Message

%HMM_ASYNC-3-SIMM_FAILED_DOWNLOAD: Unable to download modem firmware image to Simm [dec] in slot [dec].

Explanation The modem firmware failed to load onto the SIMM.

Recommended Action If the firmware has successfully loaded into the remaining SIMMs, remove or replace the defective SIMM before continuing. Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%HMM_ASYNC-3-SIMM_RUNTIME_ERROR: Simm [dec] in slot [dec] has halted due to a Runtime Error

Explanation The portware running on the SIMM was halted because of a runtime error. The six modems contained on the SIMM have been marked "bad" and are no longer usable until the system is reloaded.

Recommended Action Copy the error message exactly as it appears, along with output of the show modem and show modem log commands, and report this information to your Cisco technical support representative.

Error Message

%HMM_ASYNC-3-TDM_SYNTHESIS_ERROR: HMM Digital Modem Card [dec] experienced a TDM Synthesis Error

Explanation The digital modem card has failed to send or receive pulse code modulation (PCM) data in time to avoid a data loss. This condition may cause the modems to shift speed, retrain, or hangup.

Recommended Action Ensure that the DS1 interfaces share a common clock source. Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%HMM_ASYNC-3-UNKNOWNPLATFORM: Unknown Platform type to support HMM Network Module

Explanation The network module is not compatible with the current platform into which it is plugged.

Error Message

%HMM_ASYNC-3-UNKNOWN_MESSAGE: Received unknown message 0x[hex] at mail offset [dec] from modem [dec]/[dec]

Explanation An unidentified message has been received from the modem. This error is usually the result of running an incompatible version of modem firmware.

HOOD Messages

The following are LAN controller 100VG-AnyLAN interface error messages.

Error Message

%HOOD-3-BADUNIT: msgtxt_badunit

Explanation An internal software error has occurred.

Error Message

%HOOD-5-CABLEERR: Unit [dec], HP100VG, cable error. Training failed

Explanation A 100VG cable or hub is defective.

Error Message

%HOOD-5-COLL: Unit [dec], excessive collisions

Explanation An Ethernet cable is broken or unterminated, or the transceiver is unplugged.

Recommended Action If the transceiver appears to be properly terminated, repair or replace the router.

Error Message

%HOOD-5-LOSTCARR: Unit [dec], lost carrier. Transceiver problem

Explanation An Ethernet transceiver is unplugged or defective.

Recommended Action Repair or replace the controller.

Error Message

%HOOD-5-NOCABLE: Unit [dec], HP100VG, no tone detected. Check cable, hub

Explanation A 100VG cable is defective.

HP100VG Messages

The following are 100VG-AnyLAN PA driver error messages.

Error Message

%HP100VG-1-ACCESS: [chars] access to network denied

Explanation Access to the network is denied because of an incompatible configuration.

Recommended Action Check the configuration of the hub for Frame Format, Promiscuous, and Repeater bit to ensure proper configuration.

Error Message

%HP100VG-5-CABLEERR: [chars] training failed

Explanation An 100VG cable or hub is defective.

Recommended Action Repair or replace the cable or hub. If the cable or hub appears to be functioning, repair or replace the voice gateway (VG) port adapter (PA) interface module.

Error Message

%HP100VG-1-DISCOVER: Only found [dec] interfaces on bay [dec], shutting down bay

Explanation No voice gateway (VG) interface was detected.

Recommended Action Ensure that the 100VG port adapter (PA) is properly seated in the slot. Otherwise, repair or replace the 100VG PA interface module.

Error Message

%HP100VG-1-DUPMAC: On [chars] LAN segment

Explanation Two voice gateway (VG) devices on the same LAN segment have the same MAC address.

Recommended Action Check router configuration to ensure that no duplicate MAC address is configured.

Error Message

%HP100VG-1-LANCNF: [chars] configuration not compatible with the network

Explanation The configuration of the router module is not compatible with the network.

Recommended Action Check the configuration of the hub for Frame Format, Promiscuous, and Repeater bit to ensure proper configuration.

Error Message

%HP100VG-5-LOSTCARR: [chars] cable/hub problem

Explanation The voice gateway (VG) controller has detected that a link to the hub is down because of a cable, hub, or VG controller problem.

Recommended Action Repair or replace the cable or hub. If the cable and hub appear to be functioning, repair or replace the VG port adapter (PA) interface module.

Error Message

%HP100VG-5-NOCABLE: [chars] cable fault; tone not detected

Explanation An 100VG cable is defective.

Recommended Action Repair or replace the cable. If the cable appears to be functioning, repair or replace the voice gateway (VG) PA interface module.

Error Message

%HP100VG-3-NOCAM: [chars] hardware CAM device not found

Explanation The hardware content-addressable memory (CAM) could not be found on the PA module.

Recommended Action Repair or replace the 100VG PA interface module.

Error Message

%HP100VG-3-NOTHP100VG: Bay [dec] device ID seen as [hex], expected [hex]

Explanation The 100VG protocol control information (PCI) device could not be found.

Recommended Action Ensure that the 100VG PA device is properly seated in the slot. Otherwise, repair or replace the 100VG PA interface module.

Error Message

%HP100VG-3-OWNERR: [chars] packet buffer, pak=0x[hex]

Explanation A software or hardware error has occurred. The HP100VG driver detected that the buffer ring is in an inconsistent and unrecoverable state.

Error Message

%HP100VG-1-TRAINFAIL: [chars] unable to login to the hub

Explanation An attempt to log in to the hub has failed.

Recommended Action Take action based on the error messages that follow this message.

HTSP Messages

The following are analog voice hardware adaptation layer software error messages.

Error Message

%HTSP-3-CAPABILITYMISMATCH: voice port [chars]: call connection id [0x[hex] 0x[hex] 0x[hex] 0x[hex]]

Explanation The features between the two call legs did not match. The features are negotiated between call legs for codec, voice activity detection (VAD) and fax rates.

Recommended Action Ensure that the dial peer configuration is appropriate for the interface in question. Also ensure that the configuration on the interface is correct.

Error Message

%HTSP-3-DSPALARM: voice port [chars]: status=0x[hex] message=0x[hex] text=[chars]

Explanation The domain specific part (DSP) has reported a fatal error. All calls on the DSP were dropped and a DSP reload was attempted.

Recommended Action Verify that the DSP reloaded properly by attempting to place a call on the affected voice port. Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%HTSP-3-NOEVENT: no free event structure available from [chars] for DSP message

Explanation There were no event structures remaining in the system pools to alert the router of a voice or signalling event.

Recommended Action Check that the voice port for which the event was reported is still operational. If not, clear the voice port.

Error Message

%HTSP-3-TRUNKNOTSUPPORTED: voice port [chars]: Ground Start trunking not supported

Explanation This voice port does not support the connection trunk command when ground start signalling is configured. The trunking mode on this voice port is supported when loop-start signalling has been initiated.

Recommended Action Shut down the voice port and remove the connection trunk or signal groundstart command from the voice port configuration.

Error Message

%HTSP-5-UPDOWN: Trunk port(channel) [[chars]] is [chars]

Explanation The trunk port:channel has changed state.

Recommended Action No action is required.

HUB Messages

The following are Cisco Ethernet hub error messages.

Error Message

%HUB-1-BADHUB: Invalid hub type [dec] and number [dec]

Explanation An internal software error has occurred.

Error Message

%HUB-1-BADUNIT: Bad port number [dec]

Explanation An internal software error has occurred.

Error Message

%HUB-1-NOMEMORY: msgtxt_nomemory

Explanation The system has detected that there is not enough memory for the hub initialization.

Recommended Action Reduce other system activity to ease memory demands. If conditions warrant, upgrade to a larger memory configuration.

Error Message

%HUB-1-READERR: Read op [dec] not allowed

Explanation An internal software error has occurred.

Error Message

%HUB-1-WRITEERR: Write op [dec] not allowed

Explanation An internal software error has occurred.

IBM2692 Messages

The following are IBM Token Ring chipset error messages.

Error Message

%IBM2692-1-DISCOVER: Only found [dec] interfaces on bay [dec], shutting down bay

Explanation One of the interface controller devices on the module did not initialize properly.

Recommended Action Power down, reinsert the network module, and reboot the system. If the message recurs, call your Cisco technical support representative for assistance.

Error Message

%IBM2692-1-LL_QUEUE_OVERFLOW: IBM2692 ([dec]/[dec]), LL queue overflow

Explanation A packet buffer queue has overflowed. This message indicates that a packet was lost, probably because of traffic congestion.

Recommended Action A small number of queue overflows might not be a cause for concern. Reducing the load on the router or installing a higher-performance router should alleviate queue overflows.

Error Message

%IBM2692-1-NOPCIMEMORY: [chars] [chars] creation failed

Explanation The router or access server could not allocate memory for the indicated descriptors.

Error Message

%IBM2692-1-OLDREV: Bay [dec] port adapter requires Rev 2 CPU

Explanation The Token Ring protocol control information (PCI) port adapter driver depends on the capabilities of the Revision 2 processor.

Recommended Action Upgrade the processor to Revision 2.

Error Message

%IBM2692-1-SRBQ_OVERFLOW: Queue size on [chars] exceeded [dec]

Explanation The maximum number of commands that can be queued to the Token Ring port has been exceeded. Normally, such a problem is temporary, depending on transient peak loads within the system.

Recommended Action The system should recover. No action is required.

IDMGR Messages

The following are ID manager error messages.

Error Message

%IDMGR-3-INTERRUPT: [chars]

Explanation An id_get attempted at the interrupt level.

Error Message

%IDMGR-3-INVALID_ID: bad id in [chars]

Explanation An ID Manager error has occurred.

Error Message

%IDMGR-3-MALLOC_FAILURE: [chars]

Explanation A malloc failure has occurred in ID Manager.

IDS Messages

The following are IP datagram subsystem (IDS) messages.

Error Message

%IDS-4-ICMP_ECHO_REPLY_SIG: Sig:2000:ICMP Echo Reply - from [int] to [int]

Explanation An IP datagram has been received with the "protocol" field of the IP header set to 1 (ICMP) and the "type" field in the Internet Control Message Protocol (ICMP) Router Discovery Protocol header set to 0 (Echo Reply). IP datagrams using these fields are an extremely common part network traffic. However, suspicion should be raised when a large number of these packets are found on the network.

Recommended Action If there is no legitimate reason for this type of traffic, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-ICMP_ECHO_SIG: Sig:2004:ICMP Echo Request - from [int] to [int]

Explanation An IP datagram has been received with the "protocol" field of the IP header set to 1 (ICMP) and the "type" field in the Internet Control Message Protocol (ICMP) Router Discovery Protocol header set to 8 (Echo Request). These fields are commonly used to perform reconnaissance sweeps. The ICMP Echo Request is issued by the source to determine if the destination is "alive.' When the destination receives the request, it will reply with an ICMP Echo Reply. This request/reply pair is most commonly implemented using the "ping" utility. Many network management tools use this utility or some derivative of it, and instances of its use are extremely common network traffic. However, suspicion should be raised when a large number of these packets are found on the network.

Recommended Action If there is no legitimate reason for this type of traffic, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-ICMP_FRAGMENT_SIG: Sig:2150:Fragmented ICMP Traffic - from [int] to [int]

Explanation An IP datagram has been received with the "protocol" field of the IP header set to 1 (ICMP) and either the "more fragments" flag set to 1 (ICMP) or an indication that an offset has been set in the offset field.IP datagrams may be fragmented normally as they are transported across the network, but Internet Control Message Protocol (ICMP) is rarely fragmented. The traffic should be investigated.

Recommended Action If no legitimate reason for the fragmentation can be found and, especially, if the packets seem to be originating from a single source, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-ICMP_INFO_REPLY_SIG: Sig:2010:ICMP Information Reply - from [int] to [int]

Recommended Action When nonspecific network traffic of this type is encountered, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-ICMP_INFO_SIG: Sig:2009:ICMP Information Request - from [int] to [int]

Explanation An IP datagram is received with the "protocol" field of the IP header set to 1 (ICMP) and the "type" field in the Internet Control Message Protocol (ICMP) header set to 15 (Information Request). This datagram type is obsolete and should not be encountered.

Recommended Action When non-specific network traffic of this type is encountered, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-ICMP_MASK_REPLY_SIG: Sig:2012:ICMP Address Mask Reply - from [int] to [int]

Explanation An IP datagram has been received with the "protocol" field of the IP header set to 1 (ICMP) and the "type" field in the Internet Control Message Protocol (ICMP) header set to 18 (Address Mask Reply). No known exploits incorporate this option.The Internet Control Message Protocol (ICMP) Address Mask Request/Reply pair can be used to determine the subnet mask used on the network. When the requesting system issues the Address Mask Request bound for a destination, the destination system responds with an Address Mask Reply message. Although this type of dialogue can sometimes be part of normal network traffic, it is uncommon on most networks. Suspicion should be raised when a large number of these packets are found on the network.

Recommended Action If no legitimate reason for this traffic can be identified, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-ICMP_MASK_SIG: Sig:2011:ICMP Address Mask Request - from [int] to [int]

Explanation An IP datagram has been received with the "protocol" field of the IP header set to 1 (ICMP) and the "type" field in the Internet Control Message Protocol (ICMP) header set to 17 (Address Mask Request). ICMP Address Mask Requests could be used to perform reconnaissance sweeps of networks. The ICMP Address Mask Request/Reply pair can be used to determine the subnet mask used on the network. When the requesting system issues the Address Mask Request bound for a destination, the destination system responds with an Address Mask Reply message. Although this type of dialogue can sometimes be part of normal network traffic, it is uncommon on most networks. Suspicion should be raised when a large number of these packets are found on the network.

Recommended Action If no legitimate reason for this traffic can be identified, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-ICMP_PARAMPROB_SIG: Sig:2006:ICMP Parameter Problem on Datagram - from [int] to [int]

Explanation An IP datagram has been received with the "protocol" field of the IP header set to 1 (ICMP) and the "type" field in the Internet Control Message Protocol (ICMP) header set to 12 (Parameter Problem on Datagram). ICMP Parameter Problem datagrams are issued when a router has had to drop a malformed datagram. Dropping malformed datagrams is a normal and necessary type of network traffic. However, large numbers of this datagram type on the network are indicative of network difficulties or hostile actions.

Recommended Action If no network problems can be identified to account for the traffic, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-ICMP_PING_OF_DEATH_SIG: Sig:2154:ICMP Ping of Death Attack - from [int] to [int]

Explanation An IP datagram has been received with the "protocol" field of the IP header set to 1(ICMP), the Last Fragment bit set, and an IP offset of (* 8 ) + (IP data length) "is greater than" (the IP offset which represents the starting position of this fragment in the original packet, and which is 8 bytes in unit length) plus the rest of the packet that exceeded the maximum size for an IP packet. This indicates a denial-of-service attack. It is likely that the source address has been spoofed, thus making shunning ineffective.

Error Message

%IDS-4-ICMP_REDIRECT_SIG: Sig:2003:ICMP Redirect - from [int] to [int]

Explanation An IP datagram has been received with the "protocol" field of the IP header set to 1 (ICMP) and the "type" field in the Internet Control Message Protocol (ICMP) header set to 5 (Redirect). This redirect message may be issued from a router to inform the host of a better route to a requested destination. The host then updates the routing table to include this route. This method of updating routing tables is an uncommon practice today.

Recommended Action When nonspecific network traffic of this type is encountered, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-ICMP_SOURCEQUENCH_SIG: Sig:2002:ICMP Source Quench - from [int] to [int]

Explanation An IP datagram has been received with the "protocol" field of the IP header set to 1 (ICMP) and the "type" field in the Internet Control Message Protocol (ICMP) header set to 4 (Source Quench). This datagram may be used in network management to provide congestion control. A source quench packet will be issued when a router is beginning to lose packets because of the transmission rate of a source. The source quench is a request to the source to reduce the rate of datagram transmission. This datagram type is rarely, if ever, seen on networks, and some systems do not even support it. Large numbers of this datagram type on the network are indicative of network difficulties or hostile actions.

Recommended Action If no network problems can be identified to account for the traffic, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-ICMP_TIME_REPLY_SIG: Sig:2008:ICMP Timestamp Reply - from [int] to [int]

Explanation An IP datagram has been received with the "protocol" field of the IP header set to 1 (ICMP) and the type field in the Internet Control Message Protocol (ICMP) header set to 14 (Timestamp Reply). The ICMP Timestamp Request/Reply pair can be used to synchronize the system clocks on the network. When the requesting system issues the Timestamp Request bound for a destination, the destination system responds with a Timestamp Reply message. Although this can be is normal network traffic, but is uncommon on most networks. Suspicion should be raised when a large number of these packets are found on the network.

Recommended Action If no legitimate reason for this traffic can be identified, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-ICMP_TIME_SIG: Sig:2007:ICMP Timestamp Request - from [int] to [int]

Explanation An IP datagram has been received with the "protocol" field of the IP header set to 1 (ICMP) and the "type" field in the Internet Control Message Protocol (ICMP) header set to 13 (Timestamp Request). ICMP Timestamp Requests could be used to perform reconnaissance sweeps of networks. The ICMP Timestamp Request/Reply pair can be used to synchronize system clocks on the network. The requesting system issues the timestamp Request bound for a destination, and the destination system responds with a Timestamp Reply message. This is normal network traffic, but it is uncommon on most networks. Suspicion should be raised when a large number of these packets are found on the network.

Recommended Action If no legitimate reason for this traffic can be identified, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-ICMP_TIMXCEED_SIG: Sig:2005:ICMP Time Exceeded for a Datagram - from [int] to [int]

Explanation An IP datagram has been received with the "protocol" field of the IP header set to 1 (ICMP) and the "type" field in the Internet Control Message Protocol (ICMP) header set to 11(Time Exceeded for a Datagram). No known exploits incorporate this option. ICMP Time Exceeded datagrams are issued when a router has had to drop a datagram whose Time to Live (TTL) flag has expired. The issuance of ICMP Time Exceeded datagrams is a normal and necessary type of network traffic. However, large numbers of this datagram type on the network are indicative of network difficulties or hostile actions.

Recommended Action If no network problems can be identified to account for the traffic, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-ICMP_TOOLARGE_SIG: Sig:2151:Large ICMP Traffic - from [int] to [int]

Explanation It is possible to receive Internet Control Message Protocol (ICMP) datagrams that have a size greater than 1024 bytes, but this is a highly unusual occurrence that warrants investigation.

Recommended Action If no legitimate reason for the large packet size can be found, especially if the packets seem to be originating from a single source, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-ICMP_UNREACH_SIG: 2001:ICMP Host Unreachable - from [int] to [int]

Explanation An IP datagram has been received with the "protocol" field of the IP header set to 1 (ICMP) and the "type" field in the Internet Control Message Protocol (ICMP) header set to 3 (Host Unreachable). A Host Unreachable ICMP datagram is a common response provided to a client when there is no path available to the requested host. However, large numbers of this datagram type on the network are indicative of network difficulties or hostile actions.

Recommended Action If no network problems can be identified to account for the traffic, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-IPFRAG_ATTACK_SIG: Sig:1100:IP Fragment Attack - from [int] to [int]

Explanation An IP datagram has been received with the "more fragments" flag set to 1 or an offset indicated in the offset field.

Recommended Action IP datagrams may be fragmented when they are transported across the network. This is not uncommon, but is unusual enough that the traffic should be investigated, especially if the network is protected by a packet-filtering firewall.

Error Message

%IDS-4-IPOPTS_BAD_SIG: Sig:1000:Bad IP Option List - from [int] to [int]

Explanation An IP datagram has been received with the list of IP options in the IP datagram header incomplete or malformed. No known exploits purposely incorporate this option. There is no legitimate use for malformed datagrams. The receipt of the malformed datagrams may be indicative of systems that are experiencing problems with their kernel or NIC cards. This unusual traffic warrants investigation.

Recommended Action When nonspecific network traffic of this type is encountered, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-IPOPT_LSRR_SIG: Sig:1004:IP options-Loose Source Route - from [int] to [int]

Explanation An IP datagram has been received with an IP option list datagram that includes option 3 (Loose Source Route). This option may be misused to defeat authentication mechanisms that rely on IP addresses as their basis for trust relationships. While network troubleshooting may require the legitimate use of this feature, this type of traffic is rarely, if ever, seen and should make up much less than 1% of network traffic. Small amounts of source-routed traffic probably indicate that a network problem is being investigated.

Recommended Action Large amounts of source-routed traffic are more suspicious and warrant a thorough investigation.

Error Message

%IDS-4-IPOPT_RR_SIG: Sig:1001:IP options-Record Packet Route - from [int] to [int]

Explanation An IP datagram has been received with an IP option list for the datagram that includes one or more options that perform various network management or debugging tasks. This alarm may indicate that a reconnaissance attack is in progress against your network. While network troubleshooting may require the legitimate use of this feature, this is unusual traffic that warrants investigation.

Recommended Action When nonspecific network traffic of this type is encountered, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-IPOPT_SATID_SIG: Sig:1005:IP options-SATNET ID - from [int] to [int]

Explanation An IP datagram has been received with an IP option list for the datagram that includes option 8 (SATNET stream identifier). This option is obsolete and should not be encountered.

Recommended Action When nonspecific network traffic of this type is encountered, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-IPOPT_SECURITY_SIG: Sig:1003:IP options-Provide s,c,h,tcc - from [int] to [int]

Explanation An IP datagram in has been received with an IP option list for the datagram that includes option 2. This signature will be triggered if you have implemented IP security options on your network. However, this is rarely, if ever, implemented.

Recommended Action When nonspecific network traffic of this type is encountered, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-IPOPT_TS_SIG: Sig:1002:IP options-TimeStamp - from [int] to [int]

Explanation An IP datagram has been received with an IP option list for the datagram includes option 4 (Timestamp). This alarm indicates that a reconnaissance attack may be in progress against your network. Although network troubleshooting may require the legitimate use of this feature, this is unusual traffic that warrants investigation.

Recommended Action When nonspecific network traffic of this type is encountered, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-IP_IMPOSSIBLE_SIG: Sig:1102:Impossible IP Packet - from [int] to [int]

Explanation An IP packet has arrived with the source equal to the destination address. IP packets having identical source and destination addresses should never occur in legitimate traffic. This condition warrants an investigation.

Recommended Action Investigate the suspicious traffic.

Error Message

%IDS-4-IP_UNKNOWN_PROTO_SIG: Sig:1101:Unknown IP Protocol - from [int] to [int]

Explanation An IP datagram has been received with the protocol field set to 101 or greater. Locally developed protocols that may use a protocol type that will trigger this signature for a protocol field set to 101 or greater. The use of these protocol types is highly unusual and should be investigated.

Recommended Action When nonspecific network traffic of this type is encountered, perform prudent security measures to block the source of this communication.

Error Message

%IDS-4-LOST_CONNECT: Connection to HostID:[int] OrgID:[int]

Explanation A connection has been dropped, but there was no previous connection.

Recommended Action The Internal Data Services (IDS) cannot communicate with the Director. Check the connectivity to the Director and check the Postoffice configuration on both the router and the Director.

Error Message

%IDS-4-RPC_CALLIT_REQUEST: Sig:6103:Proxied RPC Request - from [int] to [int]

Explanation A proxied remote-procedure call (RPC) request has been sent to the portmapper of a target host.

Recommended Action If this procedure is allowed on your network, those users that employ it will trigger the signature. If the procedure is not allowed on your network, use of it may indicate a serious attempt at gaining unauthorized access. If the source of the attempt is not within your network, it should be blocked.

Error Message

%IDS-4-RPC_DUMP_REQUEST: Sig:6102:RPC Dump - from [int] to [int]

Explanation A remote-procedure call (RPC) dump request has been issued to a target host. This is a common procedure performed by many system administrators and wary users to determine which RPC services are being offered. A novice user or system administrator may have executed this procedure while performing system maintenance.

Recommended Action If upon investigation no valid user can be associated with this event, perform prudent security measures to block the source of this procedure execution.

Error Message

%IDS-4-RPC_PORTREQ_MOUNTD: Sig:6155:RPC mountd Portmap Request - from [int] to [int]

Explanation A request was made to the portmapper for the mount daemon (mountd) port.

Recommended Action If this procedure is allowed on your network, those users that employ it will trigger the portmap request signature. If performed by an unknown user, this procedure may indicate a serious attempt at gaining unauthorized access, and that user should be blocked.

Error Message

%IDS-4-RPC_PORTREQ_REXD: Sig:6175: RPC rexd Portmap Request - from [int] to [int]

Explanation A request has been made to the portmapper for the remote execution daemon (rexd) port. The remote execution daemon is the server responsible for remote program execution. This message may indicate an attempt to gain unauthorized access to the system resources.

Error Message

%IDS-4-RPC_PORTREQ_YPBIND: Sig:6151:RPC ypbind Portmap Request - from [int] to [int]

Explanation A request has been made to the portmapper for the YP bind daemon (ypbind) port.

Error Message

%IDS-4-RPC_PORTREQ_YPPASSWDD: Sig:6152:RPC ypbind yppasswdd Portmap Request - from [int] to [int]

Explanation A request has been made to the portmapper for the YP password daemon (yppasswdd) port.

Error Message

%IDS-4-RPC_PORTREQ_YPSERV: Sig:6150:RPC ypserv Portmap Request - from [int] to [int]

Explanation A request has been made to the portmapper for the YP server daemon (ypserv) port.

Error Message

%IDS-4-RPC_PORTREQ_YPUPDATED: Sig:6153:RPC ypupdated Portmap Request - from [int] to [int]

Explanation A request has been made to the portmapper for the YP update daemon (ypupdated) port.

Error Message

%IDS-4-RPC_PORTREQ_YPXFRD: Sig:6154:RPC ypxfrd Portmap Request - from [int] to [int]

Explanation A request has been made to the portmapper for the YP transfer daemon (ypxfrd) port.

Error Message

%IDS-4-RPC_REXD_REQUEST: Sig:6180:RPC rexd Attempt - from [int] to [int]

Explanation A call has been made to the remote execution daemon (rexd) program. The remote execution daemon is the server responsible for remote program execution. This message may indicate an attempt by an unauthorized user to gain unauthorized access to the system resources.

Recommended Action Even if this request for the remote program execution service was made by an authorized user, this warning will occur. For security purposes, this service really should not be used.

Error Message

%IDS-4-RPC_SET_REQUEST: Sig:6100:RPC Port Registration - from [int] to [int]

Explanation Attempts have been made to register new remote-procedure call (RPC) services on a target host.

Recommended Action There are no benign reasons why this this signature would be triggered. Perform prudent security measures to block the source of execution this procedure.

Error Message

%IDS-4-RPC_STATD_OVFLW: Sig:6190:statd Buffer Overflow - from [int] to [int]

Explanation A large statd request has been sent.

Recommended Action There are no benign reasons why this signature would be triggered. Perform prudent security measures to block the source of execution of this procedure.

Error Message

%IDS-4-RPC_UNSET_REQUEST: Sig:6101:RPC Port Unregistration - from [int] to [int]

Explanation Attempts have been made to unregistered new remote-procedure call (RPC) services on a target host.

Recommended Action There are no benign reasons why this signature would be triggered. Perform prudent security measures to block the source of this procedure execution.

Error Message

%IDS-4-STR_MATCH_SIG: Sig:8000:FTP Retrieve Password File - from [int] to [int]

Explanation This message appears whenever the "passwd" string is issued during an File Transfer Protocol (FTP) session. Although system administrators might use this service to update the system files, using it on a regular basis creates a high security risk and therefore should be avoided. No other benign triggers exist for this signature.

Recommended Action If upon investigation it is confirmed that this alarm was not generated by a system administrator, perform prudent security measures to block the source of this procedure execution.

Error Message

%IDS-4-TCP_FIN_ONLY_SIG: Sig:3042:TCP - FIN bit with no ACK bit in flags - from [int] to [int]

Explanation A TCP packet has been received with the FIN bit set but with no ACK bit set in the flags field. There is no legitimate use for malformed TCP datagrams. This is unusual traffic and warrants an investigation. Hacker tools will generate CP packets with the FIN bit set but with no ACK bit set in the flags field in an attempt to avoid intrusion detection.

Recommended Action When nonspecific network traffic of this type is encountered, perform prudent security measures to block the source of this procedure execution.

Error Message

%IDS-4-TCP_FTP_CWDROOT_SIG: Sig:3152:FTP CWD ~root - from [int] to [int]

Explanation A user has entered the cwd ~root command. There is no known reason why this command should ever be executed.

Recommended Action If this signature is triggered from a source outside the network, take the appropriate security measures to block the source.

Error Message

%IDS-4-TCP_FTP_PORT_BADADDR_SIG: Sig:3153:FTP Improper Address Specified - from [int] to [int]

Explanation A port command has been issued with an address that is not the same as the address of the requesting host.

Error Message

%IDS-4-TCP_FTP_PORT_BADPORT_SIG: Sig:3154:FTP Improper Port Specified - from [int] to [int]

Explanation A port command has been issued with an invalid data port specified (less than 1024 or greater than 65535).

Error Message

%IDS-4-TCP_FTP_SITE_SIG: Sig:3150:FTP Remote Command Execution - from [int] to [int]

Explanation A user has attempted to execute the ftp site command. Entering the ftp site command will allow a user to execute a limited number of commands through the FTP server on the host machine. No authentication is required by the user in order to execute the ftp site command. On many systems the ftp site command is not implemented.

Recommended Action If possible, disable the ftp site command on the FTP servers. If this message was triggered from a source outside the network, take the necessary security measures to block the source.

Error Message

%IDS-4-TCP_MAJORDOMO_EXEC_BUG: Sig:3107:Majordomo Execute Attack - from [int] to [int]

Explanation A bug in the Majordomo program will allow remote users to execute arbitrary commands at the privilege level of the server.

Recommended Action If this message was triggered from a source outside the network, take the necessary security measures to block the source.

Error Message

%IDS-4-TCP_NO_FLAGS_SIG: Sig:3040:TCP - No bits set in flags - from [int] to [int]

Explanation A TCP packet has been received with no bits set in the flags field. There is no legitimate use for malformed TCP datagrams. This is unusual traffic and warrants an investigation. Hacker tools will generate TCP packets with the FIN bit set but with no ACK bit set in the flags field in an attempt to avoid intrusion detection.

Recommended Action When nonspecific network traffic of this type is encountered, take the necessary security measures to block the source.

Error Message

%IDS-4-TCP_SENDMAIL_BAD_FROM_SIG: Sig:3102:Sendmail Invalid Sender - from [int] to [int]

Explanation A mail message with a pipe (|) symbol in the "From:" field has been received, indicating that a user attempted to execute a program through the e-mail server.

Recommended Action For security reasons, users should not be allowed to execute programs via e-mail servers. If the message was triggered by the actions of an unknown user, it could indicate that your network may be under attack. If this message was triggered from a source outside the network, take the necessary security measures to block the source.

Error Message

%IDS-4-TCP_SENDMAIL_BAD_TO_SIG: Sig:3101:Sendmail Invalid Recipient - from [int] to [int]

Explanation An e-mail message with a pipe (|) symbol in the recipient field has been received, indicating that a user may have attempted to execute a program through the e-mail server.

Error Message

%IDS-4-TCP_SENDMAIL_BOUNCE_SIG: Sig:3100:Smail Attack - from [int] to [int]

Explanation A very common "smail" attack against e-mail servers has occurred. The "smail" attack attempts to cause e-mail servers to execute programs on behalf of the attacker.

Error Message

%IDS-4-TCP_SENDMAIL_DECODE: Sig:3105:Sendmail Decode Alias - from [int] to [int]

Explanation An e-mail message with ": decode@" in the header was received. The decode alias is used to uudecode files and is primarily implemented as a convenience for system administration. For security purposes, the decode alias should not be used to uudecode files, and this service should be disabled. If the service is allowed, users that mail to the decode alias alias cause this message to appear as a warning.

Recommended Action If this message was triggered from a source outside of the network, take the necessary security measures to block the source.

Error Message

%IDS-4-TCP_SENDMAIL_INVALID_COMMAND: Invalid SMTP command - from [int] to [int]

Explanation An invalid Simple Mail Transfer Protocol (SMTP) command in the SMTP connection has been received. The receipt of an invalid SMPT command may signify the detection of a suspicious violation and attack on the mail server system.

Recommended Action This is unusual traffic and may warrant investigation.

Error Message

%IDS-4-TCP_SENDMAIL_OLD_SIG: Sig:3104:Archaic Sendmail Attacks - from [int] to [int]

Explanation wiz or debug commands were sent to the Simple Mail Transfer Protocol (SMTP) port. There is no reason for this type of traffic to be seen on modern networks.

Recommended Action Although there is little chance that there will be any adverse affects from someone attempting these old hacker commands, take the necessary security measures to block the source.

Error Message

%IDS-4-TCP_SENDMAIL_VRFY_SIG: Sig:3103:Sendmail Reconnaissance - from [int] to [int]

Explanation expn or vrfy commands were sent to the Simple Mail Transfer Protocol (SMTP) port. The expn and vrfy commands are commonly used to verify that a user e-mail account exists on the server or to expand an alias to determine who the actual recipients of an e-mail message may be. Users that send the expn and vrfy commands to the SMTP port for legitimate purposes will trigger this signature. The information that can be obtained is useful, but not dangerous on its own.

Recommended Action Monitoring the future traffic for patterns of misuse is recommended.

Error Message

%IDS-4-TCP_SYN_ATTACK_SIG: Sig:3050:Half-Open Syn Flood - from [int] to [int]

Explanation The number of half-open TCP connections exceeds the high-water mark or the one minute high rate mark. There are no known sources that would legitimately generate this traffic pattern.

Recommended Action This error message may be indicative of some type of network problem and should be investigated. To avoid depletion of your network resources, it is recommended that the source be blocked during the course of the investigation. If no network problems are discovered, take the necessary security measures to permanently block the source.

Error Message

%IDS-4-TCP_SYN_FIN_SIG: Sig:3041:TCP - SYN and FIN bits set - from [int] to [int]

Explanation A TCP packet has been received with both the SYN and FIN bits set in the flags field. There is no legitimate use for malformed TCP datagrams. This is unusual traffic and warrants an investigation. Hacker tools will generate CP packets with the SYN and FIN bits set in the flags field in an attempt to avoid intrusion detection.

Recommended Action When nonspecific network traffic of this type is encountered, take the necessary security measures to block the source.

Error Message

%IDS-4-UDP_BOMB_SIG: Sig:4050:UDP Bomb - from [int] to [int]

Explanation A malformed packet, one in which the User Datagram Protocol (UDP) length specified is less than the specified IP length, has been received. This malformed packet type is associated with a denial-of-service attack. There is no legitimate use for malformed datagrams. The receipt of the malformed datagram may be indicative of systems that are experiencing problems with their kernel or NIC cards. This is unusual traffic and warrants an investigation.

Recommended Action When nonspecific network traffic, such as the receipt of malformed datagrams, is encountered, take the necessary security measures to block the source.

Error Message

%IDS-4-UDP_TFTP_PASSWD_SIG: Sig:4100:Tftp Passwd File - from [int] to [int]

Explanation A user has attempted to use Trivial File Transfer Protocol (TFTP) to transfer a password file from one computer to another over the network. System administrators might use TFTP to update the system files. Using TFTP to update the system files on a regular basis creates a high security risk and should be avoided.

Recommended Action Since no other benign triggers exist for this signature, the receipt of this error message warrants an investigation. If upon investigation it is confirmed that this alarm was not generated by a system administrator, take the necessary security measures to block the source.

IDTATM25 Messages

The following are IDT ATM25 network module error messages.

Error Message

%IDTATM25-1-DISCOVER: Only found [dec] interfaces on bay [dec], shutting down bay

Explanation The ATM25 network module hardware may be defective.

Error Message

%IDTATM25-3-FAILSETUPVC: Interface [chars], Failed to setup vc [dec] (Cause: [chars])

Explanation The ATM25 network module hardware may be defective.

Error Message

%IDTATM25-3-FAILTEARDOWNVC: Interface [chars], Failed to down vc [dec] (Cause: [chars])

Explanation The ATM25 network module hardware may be defective.

Error Message

%IDTATM25-1-INITFAIL: IDTATM25([dec]/[dec]), Init failed, CSR[dec]=0x[hex]

Explanation The ATM25 network module hardware may be defective.

Error Message

%IDTATM25-3-NOTIDTATM25: Device reported [hex]

Explanation The ATM25 network module hardware may be defective.

Error Message

%IDTATM25-3-UNSUPPORTED: Interface [chars], [chars] not supported

Explanation The ATM25 network module hardware may be defective.

IFS Messages

The following are Cisco IOS file system error messages.

Error Message

%IFS-4-FILEMAX: Failed to open [chars], maximum open files [dec])

Explanation The router has reached the maximum number of files that may be open at one time.

Recommended Action Close some files and try again. If this messages recurs, copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.

Error Message

%IFS-3-FSDUP: Failed to add [chars], filesystem prefix exists

Explanation A file system could not be added because another file system exists with the same name.

Error Message

%IFS-3-FSMAX: Failed to add [chars], maximum filesystems [dec]

Explanation The router has reached the maximum number of file systems that may supported at one time.

Error Message

%IFS-3-FS_CREATE_FAIL: Failed to create [chars] file system, [chars]

Explanation An internal software error has occurred.

Error Message

%IFS-3-FS_CREATE_FAIL2: Failed to create [chars] simple file system, [chars]

Explanation An internal software error has occurred.

Error Message

%IFS-3-FS_MISSING_FUNCTIONS: '[chars]' file system missing required functions, not created

Explanation Some file systems require a certain set of functions to be present in order to be usable. This file system does not support all the mandatory functionality.

IGRP Messages

The following are Interior Gateway Routing Protocol (IGRP) error messages.

Error Message

%IGRP-3-NOSOCKET: Unable to open socket for AS [dec]

Explanation The requested operation could not be accomplished because of a low memory condition.

Recommended Action Reduce other system activity to ease memory demands. If conditions warrant, upgrade to a larger memory configuration.

ILACC Messages

The following are ILACC driver error messages.

Error Message

%ILACC-4-BABBLE: Unit [dec], babble error, csr0 = 0x[hex]

Explanation An Ethernet interface has malfunctioned.

Recommended Action Determine whether the malfunction stems from a software or hardware error by turning off all fast switching. Error messages showing that the packet is too large for the link indicate a software error at a high level. Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Receiving no error messages indicates a hardware error. Repair or replace the controller.

Error Message

%ILACC-3-BADUNIT: msgtxt_badunit

Explanation An internal software error has occurred.

Error Message

%ILACC-5-COLL: Unit [dec], excessive collisions. TDR=[dec]

Explanation An Ethernet cable is broken or unterminated, or the transceiver is unplugged. The time delay reflectometer (TDR) counter is an internal ILACC counter that counts the time (in ticks of 100 ns each) from the start of a transmission to the occurrence of a collision. Because a transmission travels about 35 feet per tick, this value is useful to determine the approximate distance to a cable fault.

Recommended Action If the transceiver appears to be properly terminated, repair or replace the Ethernet interface card.

Error Message

%ILACC-1-INITFAIL: msgtxt_initfail

Explanation The hardware failed to initialize correctly.

Recommended Action Repair or replace the controller.

Error Message

%ILACC-5-LATECOLL: Unit [dec], late collision error

Explanation An Ethernet transceiver has malfunctioned, the Ethernet is overloaded, or the Ethernet cable is too long.

Recommended Action Repair or replace the controller and ensure that the Ethernet cable meets the standard length requirement.

Error Message

%ILACC-5-LOSTCARR: Unit [dec], lost carrier. Transceiver problem

Explanation An Ethernet transceiver is unplugged or defective.

Recommended Action Repair or replace the controller.

Error Message

%ILACC-1-MEMERR: msgtxt_memoryerror

Explanation An Ethernet interface has detected a hardware problem.

Recommended Action Repair or replace the controller.

Error Message

%ILACC-3-OWNERR: msgtxt_ownerror

Explanation An Ethernet interface has malfunctioned, or an internal software error has occurred.

Recommended Action Repair or replace the controller.

Error Message

%ILACC-3-SPURIDON: Unit [dec], spurious IDON interrupt, csr[dec]=0x[hex]

Explanation An Ethernet interface has generated a spurious Initialization Done interrupt.

Recommended Action Repair or replace the controller.

Error Message

%ILACC-3-UNDERFLO: Unit [dec], underflow error

Explanation The Ethernet hardware is requesting data faster than the system can supply it. This condition might indicate that the system is at the limit of its performance.

Recommended Action A small number of underflows might not be a cause for concern. You can monitor underflows with the show interface command. Reducing the load on the router or installing a higher-performance router should alleviate this problem.

IMA Messages

The following are inverse multiplexing over ATM (IMA) error messages.

Error Message

%IMA-5-ACTIVE_LINK_CHANGE: IMA Group [chars] now has [dec] active links, active link bitmap is [hex]

Explanation Active links were added or removed from the group, therefore changing its bandwidth.

Recommended Action No action is required.

Error Message

%IMA-1-BAD_CMD: Command opcode [hex] on channel [dec] on slot [dec] was rejected

Explanation The inverse multiplexing over ATM (IMA) firmware has rejected the command because of the current protocol state of the interface, or the opcode is undefined.

Error Message

%IMA-4-CLOCK_MODE_COMMON_DELAYED: Link [dec] will become the common transmit clock once it is added to group [chars]

Explanation The link configured as the common transmit clock is not a member of the group, so it cannot provide the clock function. The group will use a common transmit clock that is automatically chosen from one of the other active links.

Recommended Action No action is required.

Error Message

%IMA-1-DISCOVER: The Network Module in slot [dec] did not initialize

Explanation The network module did not initialize.

Error Message

%IMA-1-DOWNLOAD_FAILED: Download of [chars] to failed to at [hex] on IMA Network Module in slot [dec]

Explanation An error has occurred during the download of firmware to the inverse multiplexing over ATM (IMA) network module.

Error Message

%IMA-1-FPGA_DOWNLOAD_FAIL: FPGA Download on module in slot [dec] failed

Explanation An error occurred during the download of the Field Programmable Gate-Array (FPGA) on the inverse multiplexing over ATM (IMA) network module.

Error Message

%IMA-1-INVALID_PCI_ID: The Network Module in slot [dec] reports an invalid [chars] device id of [hex]

Explanation The inverse multiplexing over ATM (IMA) network module may be defective.

Error Message

%IMA-1-MAILBOX_FULL: The mailbox for channel [dec] on IMA Network Module in slot [dec] is completely full. Message [dec] was dropped

Explanation The inverse multiplexing over ATM (IMA) network module mailboxes are full and cannot accept any more requests.

Error Message

%IMA-1-NETWORK_PROCESSOR_NOT_READY: Network processor on module in slot [dec] failed to come up

Explanation An error has occurred during reset of the inverse multiplexing over ATM (IMA) network module.

Error Message

%IMA-1-NO_ATM_CHANNEL_AVAILABLE: Delaying activation of [chars] until a currently active interface is shutdown

Explanation The inverse multiplexing over ATM (IMA) network module can support a maximum of up to four active interfaces at one time. Once more than four interfaces are active, the other interfaces will wait for an existing interface to be shut down before becoming activated.

Error Message

%IMA-5-NO_LINK_MEMBERS: [chars] is using channel [dec] but has no configured links

Explanation The inverse multiplexing over ATM (IMA) interface has been configured as Up, but it has no link members. The IMA interface cannot become active until active links are added to the group.

Recommended Action No action is required.

Error Message

%IMA-1-NO_MAIL_REPLY: Timed out waiting for a response to command [hex] from slot [dec]

Explanation The inverse multiplexing over ATM (IMA) network module has failed to respond with the requested information. This message may indicate that the information to be displayed by requesting an EXEC command or Simple Network Management Protocol (SNMP) manager is incomplete. This is an extremely rare event and should happen only under severe system overload.

Error Message

%IMA-1-PCMCIA: The IMA Network Module in slot [dec] is incompatible with the PCMCIA controller in the router

Explanation The specified network module is incompatible with the PCMCIA controller in the router.

Error Message

%IMA-1-PROCESS_NEVER_RECEIVED_MAIL_REPLY: Previous process [dec] never received mail response from slot [dec]

Explanation The previous process request was terminated before receiving a mail response.

Error Message

%IMA-1-SHARED_MEMORY_ERROR: Module in slot [dec] had a shared memory error

Explanation The memory on the network module has failed the power-on diagnostic check.

Error Message

%IMA-4-TEST_LINK_DELAYED: Link [dec] will initiate the test pattern procedure once its added to group [chars]

Explanation The link chosen to transmit the test pattern is not a member of the group and therefore cannot send the test pattern.

Recommended Action No action is required.

Error Message

%IMA-4-TEST_LINK_STOPPED: Stopping test pattern procedure on group [chars]

Explanation The link that was sending the test pattern has been removed from the group and therefore cannot send the test pattern.

Recommended Action No action is required.

Table of Contents