ifTable and ifXTable columns are returned in more than one TableEvent for the same index

SNMP4J
1

Hi,

We poll a subset of ifTable and ifXTable in a single getBulk request and the response from Snmp4j was always a single TableEvent object with all the column values (the requested subset of ifEntry and ifXEntry columns) in it. We recently had to upgrade our device versions and from then , we started seeing more than one TableEvent for the same index.

Before device OS upgrade
org.snmp4j.util.TableEvent[index=92,vbs=[null, null, null, null, 1.3.6.1.2.1.31.1.1.1.7.92 = 0, null, null, 1.3.6.1.2.1.31.1.1.1.6.92 = 0, null, 1.3.6.1.2.1.2.2.1.14.92 = 0, null, null, 1.3.6.1.2.1.2.2.1.13.92 = 0, 1.3.6.1.2.1.2.2.1.10.92 = 0, 1.3.6.1.2.1.2.2.1.11.92 = 0, null, null, null, null, null, null, null, 1.3.6.1.2.1.2.2.1.3.92 = 135, null, 1.3.6.1.2.1.2.2.1.4.92 = 1518, null, 1.3.6.1.2.1.2.2.1.5.92 = 4294967295, 1.3.6.1.2.1.31.1.1.1.11.92 = 0, 1.3.6.1.2.1.2.2.1.6.92 = 4c:71:0d:f0:23:6f, 1.3.6.1.2.1.31.1.1.1.10.92 = 0, 1.3.6.1.2.1.2.2.1.1.92 = 92, 1.3.6.1.2.1.2.2.1.2.92 = TenGigE0/0/0/15.804, null, 1.3.6.1.2.1.2.2.1.19.92 = 0, 1.3.6.1.2.1.2.2.1.16.92 = 0, 1.3.6.1.2.1.31.1.1.1.19.92 = 11 days, 20:58:36.00, 1.3.6.1.2.1.2.2.1.17.92 = 0, 1.3.6.1.2.1.31.1.1.1.18.92 = T-SDN Interface, null, null, 1.3.6.1.2.1.2.2.1.20.92 = 0, null, null, null, null, null, null, null, null, 1.3.6.1.2.1.31.1.1.1.1.92 = TenGigE0/0/0/15.804, null, null, null, null, null, null, null, null, null, null, null, null, 1.3.6.1.2.1.2.2.1.7.92 = 1, 1.3.6.1.2.1.31.1.1.1.17.92 = 2, 1.3.6.1.2.1.2.2.1.8.92 = 1, 1.3.6.1.2.1.31.1.1.1.16.92 = 2, 1.3.6.1.2.1.2.2.1.9.92 = 11 days, 20:58:33.06, 1.3.6.1.2.1.31.1.1.1.15.92 = 10000, 1.3.6.1.2.1.31.1.1.1.14.92 = 2, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null],status=0,exception=null,report=null

After upgrade

org.snmp4j.util.TableEvent[index=92,vbs=[null, null, null, null, 1.3.6.1.2.1.31.1.1.1.7.92 = 0, null, null, 1.3.6.1.2.1.31.1.1.1.6.92 = 0, null, 1.3.6.1.2.1.2.2.1.14.92 = 0, null, null, 1.3.6.1.2.1.2.2.1.13.92 = 0, 1.3.6.1.2.1.2.2.1.10.92 = 0, 1.3.6.1.2.1.2.2.1.11.92 = 0, null, null, null, null, null, null, null, 1.3.6.1.2.1.2.2.1.3.92 = 135, null, 1.3.6.1.2.1.2.2.1.4.92 = 1518, null, 1.3.6.1.2.1.2.2.1.5.92 = 4294967295, 1.3.6.1.2.1.31.1.1.1.11.92 = 0, 1.3.6.1.2.1.2.2.1.6.92 = 4c:71:0d:f0:23:6f, 1.3.6.1.2.1.31.1.1.1.10.92 = 0, 1.3.6.1.2.1.2.2.1.1.92 = 92, 1.3.6.1.2.1.2.2.1.2.92 = TenGigE0/0/0/15.804, null, 1.3.6.1.2.1.2.2.1.19.92 = 0, 1.3.6.1.2.1.2.2.1.16.92 = 0, 1.3.6.1.2.1.31.1.1.1.19.92 = 11 days, 20:58:36.00, 1.3.6.1.2.1.2.2.1.17.92 = 0, 1.3.6.1.2.1.31.1.1.1.18.92 = T-SDN Interface, null, null, 1.3.6.1.2.1.2.2.1.20.92 = 0, null, null, null, null, null, null],status=0,exception=null,report=null],

org.snmp4j.util.TableEvent[index=92,vbs=[null, null, 1.3.6.1.2.1.31.1.1.1.1.92 = TenGigE0/0/0/15.804, null, null, null, null, null, null, null, null, null, null, null, null, 1.3.6.1.2.1.2.2.1.7.92 = 1, 1.3.6.1.2.1.31.1.1.1.17.92 = 2, 1.3.6.1.2.1.2.2.1.8.92 = 1, 1.3.6.1.2.1.31.1.1.1.16.92 = 2, 1.3.6.1.2.1.2.2.1.9.92 = 11 days, 20:58:33.06, 1.3.6.1.2.1.31.1.1.1.15.92 = 10000, 1.3.6.1.2.1.31.1.1.1.14.92 = 2, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null],status=0,exception=null,report=null],

Snmp4j version used - 3.7.4

Please let us know what triggers the above behavior.

Thanks,
Keertana

2

Hi Keertana,

Without knowing the content of the sent GETBULK request PDUs and the corresponding RESPONSE PDUs returned by the agent, it is impossible to judge what happened.
Most likely there is a lexicographic ordering problem in the agent, but that is just guessing.

Best regards,
Frank

3
Summary

Thank you for the response.

Is there way , I can share pcaps ? I can see option to only upload jpegs.

4

pcaps files will not help, as the content is most likely encrypted.
You can activate DEBUG log, that will show the PDU payload in the log. See How-to enable/configure logging? - SNMP4J - AGENTPP for details.

5

Thanks,

We didn’t observe the issue when the getbulk params are changed to fetch less number of rows and OIDs in a PDU.

We see 2 TableEvents for the same index, consistently with the below bulk params even though the PDU size with this combination is < MTU set. (MTU set = 1500 and the PDU size with this combination varies between 1350 - 1399)
Cr =5
oids-oper-pdu = 22

When we change the values to a combination that results in less PDU size - Ex: Cr=4, oids-per-pdu =15 or Cr=3, oids-per-pdu =22, We don’t see Snmp4j returned 2 TableEvents.

Can you please let us know the reason for this change in behavior of Snmp4j with different bulk params.

6

Hi Keertana,

Again, I am quite sure, that the agent is not correctly responding to the GETBULK requests. There are two possible error scenarios that could cause this issue:

  1. Returned variable bindings (i.e., their OIDs) are not in the lexicographic order there are present in the agent.
  2. There are less variable bindings returned for a repeater than defined by the rules for GETBULK processing (this error is similar to the previous, but the source in the agent might be different).