[c-nsp] Log messages saying %MCAST-SP-3-QUERY_INT_MISMATCH

[Phil Mayers]

On 10/07/2011 12:02 PM, Jeroen van Ingen wrote:
>
> We occasionally see a similar message, but it's a bit more informational
> in the sense that it logs the source IP for the query:

As it happens, so does mine (see my 2nd message just now) - but it logs 
it as a 2nd line, which doesn't make it into local log or syslog, and is 
only visible via "term mon"!

This is under SXJ1 BTW.

>
> %IGMP-3-QUERY_INT_MISMATCH: Received a non-matching query interval 125,
> from querier address 10.10.10.139

That's a subtly different message though, and formatted considerably 
differently. It seems to all be on one line, hence correctly appears in 
the logs I guess.

>
> This is on a Cat6k Sup720-3B running SXI2a, which is the IGMP Querier
> for the segment in question.

One thing that slightly concerns me - these messages at least imply that 
the 6500 is *not* the querier. Or rather, that some other device 
erroneously believes it is the querier, along with zero or more other 
devices on the vlan.

>
>> This is a really busy box, so a debug or packet capture isn't a great
>> way to find the cause. Any suggestions? And I'd be grateful if those of
>> you about to say "just ignore it" could assume I'm aware of that option
>> and move on ;o)
>
> Actually, we generally do ignore these messages; if I remember

We're getting hundreds a day. They fill the logs, which is tedious, and 
this is new - we didn't get this previously.

I could ignore them. I could even use the syslog filtering stuff. But it 
seems a bit retrograde to start ignoring log messages when you don't 
know the cause.

> correctly, they're usually triggered by Linux/Unix boxes running an
> IGMPv1 querier for some reason. We've never seen this having impact on

Having now identified the source IP, it's coming from our switch 
management networks. Our edge switches are Extreme x450, which do run 
Linux. I guess they're electing themselves IGMPv1 querier because they 
have a lower IP address.

> multicast forwarding; the L2 switches doing IGMP snooping don't log any
> querier changes either and I've never had an IPTV complaint from a
> timeframe where one of these messages was logged...
>
> Are the boxes you're seeing this on acting as queriers, or are they just
> doing IGMP snooping?

They ought to be the queriers, and certainly believe they are.

Cheers,
Phil