[j-nsp] OSPF neighbor Down :: without reason

[Andrew Mulheirn]

Hi -

The inactive timer is (I presume) the OSPF dead-timer expiring.  If so (and if set to defaults) it means that e.f.g.h didn't receive an OSPF hello for 40 seconds from a.b.c.d.


a.b.c.d discovering that e.f.g.h is in one-way state probably happened immediately after e.f.g.h decided a.b.c.d was dead.  I guess a.b.c.d still thought the neighbour relationship was still full, which means that either the problem with hello packets being received only affected one neighbour, or that a.b.c.d's timer hadn't expired.

Presumably the chronology is something like this:

1. e.f.g.h doesn't get hellos from a.b.c.d

2. a.b.c.d may still be getting e.f.g.h's hellos, so hasn't timed-out the neighbour relationship

2. e.f.g.h's inactive timer expires, and decides a.b.c.d is dead

3. e.f.g.h clears the neighbour state internally

4. e.f.g.h sends a hello and goes into one-way, waiting for neighbours to let themselves be known

5. a.b.c.d receives the new hello which no longer contains his RID, and clears his neighbour state to start afresh.


Sounds to me like a layer-2 issue that affected OSPF hello reception on e.f.g.h somehow.  Broadcast storm or ARP poisoning of a.b.c.d's address maybe?

Just a few random thoughts.....

Andrew

-----Original Message-----
From: juniper-nsp-bounces at puck.nether.net [mailto:juniper-nsp-bounces at puck.nether.net] On Behalf Of Keegan.Holley at sungard.com
Sent: 28 March 2008 16:39
To: Farhan Jaffer
Cc: juniper-nsp-bounces at puck.nether.net; juniper-nsp at puck.nether.net
Subject: Re: [j-nsp] OSPF neighbor Down :: without reason

This looks like a physical layer problem.  Maybe not a link flap per se but some sort of media issue.  I'm not familiar with the inactive timer though so I don't know what the first message means exactly.  The one-way message seems kind of odd as well.  Your neighbor declared you dead before you did the same.  The route only noticed because the neighbor sent a hello without it's router id in the list of known routers.  What kind of link is connecting the two routers?  Is it frame-relay or sonet?  It seems like there was a link failure that didn't lead to an interface flap.  Are there any errors on your sh int <> extensive?  Also how often does this happen.



> On 3/24/08, Farhan Jaffer <bandhani at gmail.com> wrote:
> > One side:
> > rpd[3120]: RPD_OSPF_NBRDOWN: OSPF neighbor a.b.c.d state changed
> > from Full to Down due to InActiveTimer (event reason: neighbor was
> > inactive and declared dead)
> >
> > Other side:
> > rpd[3055]: RPD_OSPF_NBRDOWN: OSPF neighbor e.f.g.h state changed
> > from Full to Init due to 1WayRcvd (event reason: neighbor is in
> > one-way
> > mode)