NBAR Query producing the wrong results.

[efly]

I worked with Deano doing some MIB decode for his NBAR scripts. I have later found that there seems to be some sort of bug when running the scripts against certain router configurations. I have a 3745 Router with two FE interfaces, Loopback interface, one HSSI interface, 25 sub-interfaces (Frame-Relay) hanging off the HSSI interface.

If I run queries against the FE interfaces I have no issues. These are low numbered iFindexes. If I run the scripts against a HSSI sub-interface (higher numbered iFindexes), the script choses the wrong interface to try to poll the NBAR MIB with. For example: If I have NBAR enabled on H1/0.400 the script will pick up H1/0.243 and try to run the MIB against that interface and will fail.

Anyone else ran into this using Deano's scripts? I can send you a copy of them if you would like to take a look at them. Deano no longer has them on his site for download.

Any help appreciated. I think there is some simple math that is messed up here but I don't know .PHP enough to debug this one.

Regards,
EF

[Guest]

In newer version of Cisco IOS you can enable "snmp-server ifindex persist"which ensures the ifindex a port is assigned never changes after a reboot. This means that if you delete an interface and then reboot the router that ifindex will be deleted but all other interface are not re-aligned .. They keep their same ifindexes. Here is a sample output from one of my routers.

1 FastEthernet0/0
10 Hssi1/0.271
11 Hssi1/0.130
12 Hssi1/0.530
13 Hssi1/0.765
14 Hssi1/0.483
15 Hssi1/0.790
16 Hssi1/0.803
18 Hssi1/0.266
19 Hssi1/0.840

If you notice I don't have a ifindex 17. This must have been an old interface that has since been deleted. With the above command installed the router doesn't renumber the interfaces. This means you can skip ifindex numbers. I have enable NBAR on one interface at a time and watched the results. I noted that when I enabled NBAR on ifindex 18 HSSI1/0.266 the script tried to go for ifindex 19 HSSI1/0.840. I am sure there is some simple math taking place here that the ifindex persistence is breaking.

Just not the .php expert to fix the problem.

EF