[c-nsp] ip virtual-reassembly?

Dan Letkeman danletkeman at gmail.com
Fri Dec 21 22:34:27 EST 2007 

Hello,

I have a router that is giving me errors like this:


%IP_VFR-4-FRAG_TABLE_OVERFLOW : [chars]: the fragment table has reached its
maximum threshold [dec]

So I did a:


Router#>show ip virtual-reassembly
GigabitEthernet0/0:
   Virtual Fragment Reassembly (VFR) is ENABLED...
   Concurrent reassemblies (max-reassemblies): 16
   Fragments per reassembly (max-fragments): 32
   Reassembly timeout (timeout): 3 seconds
   Drop fragments: OFF

   Current reassembly count:0
   Current fragment count:0
   Total reassembly count:0
   Total reassembly timeout count:0

GigabitEthernet0/1.1:
   Virtual Fragment Reassembly (VFR) is ENABLED...
   Concurrent reassemblies (max-reassemblies): 16
   Fragments per reassembly (max-fragments): 32
   Reassembly timeout (timeout): 3 seconds
   Drop fragments: OFF

   Current reassembly count:0
   Current fragment count:0
   Total reassembly count:58101
   Total reassembly timeout count:635

GigabitEthernet0/1.2:
   Virtual Fragment Reassembly (VFR) is ENABLED...
   Concurrent reassemblies (max-reassemblies): 16
   Fragments per reassembly (max-fragments): 32
   Reassembly timeout (timeout): 3 seconds
   Drop fragments: OFF

   Current reassembly count:0
   Current fragment count:0
   Total reassembly count:304646
   Total reassembly timeout count:92256


And a:

Router#>show log
Syslog logging: enabled (11 messages dropped, 1 messages rate-limited,
                0 flushes, 0 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.



No Inactive Message Discriminator.


    Console logging: level critical, 0 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level debugging, 0 messages logged, xml disabled,
                     filtering disabled
    Buffer logging:  level debugging, 2080 messages logged, xml disabled,
                     filtering disabled
    Logging Exception size (4096 bytes)
    Count and timestamp logging messages: disabled

No active filter modules.

ESM: 0 messages dropped

    Trap logging: level debugging, 2084 message lines logged

Log Buffer (51200 bytes):

001830: Dec 20 22:17:54.658 Central: IP_VFR: deleted frag state for sa:
76.27.229
.242, da:10.4.26.100, id:7572
001831: Dec 20 22:17:55.142 Central: IP VFR: frag state expired -src-addr:
76.27.
229.242, dst-addr:10.4.26.100, ip-id:7622...
001832: Dec 20 22:17:55.142 Central: IP_VFR: deleted frag state for sa:
76.27.229
.242, da:10.4.26.100, id:7622
001833: Dec 20 22:17:55.402 Central: IP VFR: frag state expired -src-addr:
76.27.
229.242, dst-addr:10.4.26.100, ip-id:10465...
001834: Dec 20 22:17:55.402 Central: IP_VFR: deleted frag state for sa:
76.27.229
.242, da:10.4.26.100, id:10465
001835: Dec 20 22:17:56.562 Central: IP_VFR: fragment (sa:76.27.229.242, da:
10.4
.26.100, id:7977, offset:1480, len:28) in fast path...
001836: Dec 20 22:17:56.562 Central: IP_VFR: created frag state for sa:
76.27.229
.242, da:10.4.26.100, id:7977...
001837: Dec 20 22:17:56.562 Central: IP_VFR: dgrm incomplete, returning...
001838: Dec 20 22:17:58.414 Central: IP_VFR: fragment (sa:66.29.87.159, da:
10.4.
16.74, id:7318, offset:0, len:1480) in fast path...
001839: Dec 20 22:17:58.418 Central: IP_VFR: created frag state for sa:
66.29.87.
159, da:10.4.16.74, id:7318...
001840: Dec 20 22:17:58.418 Central: IP_VFR: pak incomplete cpak-offset:0,
cpak-
len:1480, flag: 1
001841: Dec 20 22:17:58.418 Central: IP_VFR: dgrm incomplete, returning...
001842: Dec 20 22:17:58.450 Central: IP_VFR: fragment (sa:66.29.87.159, da:
10.4.
16.74, id:7318, offset:1480, len:502) in fast path...
001843: Dec 20 22:17:58.450 Central: IP_VFR: cpak-offset:0, cpak-len:1480,
npak-
offset:1480
001844: Dec 20 22:17:58.450 Central: IP_VFR: dgrm complete, switching the
frags.
001845: Dec 20 22:17:58.450 Central: IP_VFR: switching fragment (sa:
66.29.87.159
, da:10.4.16.74, id:7318, offset:0, len:1480)
001846: Dec 20 22:17:58.450 Central:  IP VFR:Enqueing packet to IP queue
001847: Dec 20 22:17:58.450 Central: IP_VFR: switching fragment (sa:
66.29.87.159
, da:10.4.16.74, id:7318, offset:1480, len:502)
001848: Dec 20 22:17:58.450 Central:  IP VFR:Enqueing packet to IP queue
001849: Dec 20 22:17:58.450 Central: IP_VFR: all fragments have been
switched.
001850: Dec 20 22:17:58.450 Central: IP_VFR: pak_subblock_free - pak
0x4846429C
001851: Dec 20 22:17:58.450 Central: IP_VFR: deleted frag state for sa:
66.29.87.
159, da:10.4.16.74, id:7318
001852: Dec 20 22:17:58.450 Central: IP_VFR: pak_subblock_free - pak
0x48331F9C
001853: Dec 20 22:17:59.562 Central: IP VFR: frag state expired -src-addr:
76.27.
229.242, dst-addr:10.4.26.100, ip-id:7977...
001854: Dec 20 22:17:59.562 Central: IP_VFR: deleted frag state for sa:
76.27.229
.242, da:10.4.26.100, id:7977
001855: Dec 20 22:17:59.694 Central: IP_VFR: fragment (sa:76.27.229.242, da:
10.4
.26.100, id:10884, offset:0, len:1480) in fast path...
001856: Dec 20 22:17:59.694 Central: IP_VFR: created frag state for sa:
76.27.229
.242, da:10.4.26.100, id:10884...
001857: Dec 20 22:17:59.694 Central: IP_VFR: pak incomplete cpak-offset:0,
cpak-
len:1480, flag: 1
001858: Dec 20 22:17:59.694 Central: IP_VFR: dgrm incomplete, returning...
001859: Dec 20 22:18:02.694 Central: IP VFR: frag state expired -src-addr:
76.27.
229.242, dst-addr:10.4.26.100, ip-id:10884...
001860: Dec 20 22:18:02.694 Central: IP_VFR: deleted frag state for sa:
76.27.229
.242, da:10.4.26.100, id:10884
001861: Dec 20 22:18:03.742 Central: IP_VFR: fragment (sa:76.27.229.242, da:
10.4
.26.100, id:8394, offset:1480, len:28) in fast path...
001862: Dec 20 22:18:03.742 Central: IP_VFR: created frag state for sa:
76.27.229
.242, da:10.4.26.100, id:8394...
001863: Dec 20 22:18:03.742 Central: IP_VFR: dgrm incomplete, returning...
001864: Dec 20 22:18:04.502 Central: IP_VFR: fragment (sa:76.27.229.242, da:
10.4
.26.100, id:8354, offset:1480, len:28) in fast path...
001865: Dec 20 22:18:04.502 Central: IP_VFR: created frag state for sa:
76.27.229
.242, da:10.4.26.100, id:8354...
001866: Dec 20 22:18:04.502 Central: IP_VFR: dgrm incomplete, returning...
001867: Dec 20 22:18:05.546 Central: IP_VFR: fragment (sa:76.27.229.242, da:
10.4
.26.100, id:8524, offset:1480, len:28) in fast path...
001868: Dec 20 22:18:05.546 Central: IP_VFR: created frag state for sa:
76.27.229
.242, da:10.4.26.100, id:8524...
001869: Dec 20 22:18:05.546 Central: IP_VFR: dgrm incomplete, returning...
001870: Dec 20 22:18:06.146 Central: IP_VFR: fragment (sa:76.27.229.242, da:
10.4
.26.100, id:8451, offset:1480, len:28) in fast path...
001871: Dec 20 22:18:06.146 Central: IP_VFR: created frag state for sa:
76.27.229
.242, da:10.4.26.100, id:8451...
001872: Dec 20 22:18:06.146 Central: IP_VFR: dgrm incomplete, returning...
001873: Dec 20 22:18:06.742 Central: IP VFR: frag state expired -src-addr:
76.27.
229.242, dst-addr:10.4.26.100, ip-id:8394...
001874: Dec 20 22:18:06.742 Central: IP_VFR: deleted frag state for sa:
76.27.229
.242, da:10.4.26.100, id:8394
001875: Dec 20 22:18:07.290 Central: IP_VFR: fragment (sa:76.27.229.242, da:
10.4
.26.100, id:11359, offset:0, len:1480) in fast path...
001876: Dec 20 22:18:07.290 Central: IP_VFR: created frag state for sa:
76.27.229
.242, da:10.4.26.100, id:11359...
001877: Dec 20 22:18:07.290 Central: IP_VFR: pak incomplete cpak-offset:0,
cpak-
len:1480, flag: 1


I removed the ip virtual-reassembly command from the interface giving the
problem and the errors are gone.  From what I understand that command is
used for ips and nat.  This error is showing on the lan interface of the
router.

Any suggestions on what to do with a problem like this?

Thanks,
Dan.

More information about the cisco-nsp mailing list