Even with all spoolers stopped and the network cabling (AUI to Ethernet
Transceiver) disconnected I receive:

** NETXPORT Probe; Probe request
- Loc: 40; Class: 5; Parm= $0000000000; Port ID: $FFFFFDF5
** NETXPORT Probe : RETRANSMISSION; Retransmission
- Loc: 28; Class: 5; Parm= $0000FFFF; Port ID: FFFFFDF5
** NETXPORT Probe; Max rtx's exceeded
- Loc: 36; Class: 5; Parm= $0000FFFF; Port ID: FFFFFDF5

I do have a DTC and another 918lx but with the system completely
disconnected from the outside world and the errors still coming it makes
me think the messages are being transmitted by an internal process.  Is
there a way to track down which process is generating these requests?


-----Original Message-----
From: HP-3000 Systems Discussion [mailto:[log in to unmask]] On
Behalf Of Jeff Kell
Sent: Thursday, December 11, 2003 7:33 PM
To: [log in to unmask]
Subject: Re: [HP3000-L] NETXPORT Probe; Max rtx's exceeded


Ben Ramirez wrote:

> I'm receiving about two of these messages or variations of it 
> (retransmission, probe request) a second.  I'm running MPE/iX 6.5 on a

> 918lx and am a novice when it comes to system work.  Can someone point

> me toward what I should be looking at to make these go away?

If it is indeed complaining about "Probe" that would indeed be unusual.
Probe is an HP-proprietary protocol in 802.3 format with a protocol type
field of 0x8005 (this would be the frame length field for what we now
commonly refer to as ethernet) and a SAP type 0xFC.  Nothing in it's
right mind would generate these things except a 3000, a DTC, and a
handful of routers.

HP-specific probes are sent on multicast MAC addresses 09-00-09-00-00-01
and 09-00-09-00-00-02.  You can fish them out of a sniffer quite easily
with these criteria.

Probe is the "HP-way" of doing ARP over 802.3 without needing an IP
number.  It works very much like ARP.  With ARP:

* sender doesn't know the receiver's MAC address, but does know the IP
   address.  ARP query "Who has aaa.bbb.ccc.ddd?" is broadcast, and the
   owner of that IP answers the query, providing it's MAC address.

With Probe, and classic HP3000s, you had "DS/NS names" that had been
magically working for years over HSIs, network processors, synchronous
links, and X.25.  Porting this to 802.3 (or Ethernet) married the names
directly to the MAC addresses.  So with Probe:

* sender doesn't know the receiver's MAC address, but does know the
   name.  Probe query "Who is foo.bar.net?" is multicast down the wire,
   and if the named machine hears it, sends a probe response, providing
   it's MAC address.

Some things will do Probe Proxy (some HP, Cisco, and maybe some other
routers).  But getting back to your question...

If you're the only 3000 in your neighborhood, you shouldn't be getting
any probes -- unless you are hearing your own (can happen on Thick or
Thin LAN when you exceed the length limitations or the 3-4-5 rule) or
somebody is pulling your leg.  I would suggest you get a sniffer on your
subnet and see where the Probes are coming from.

You most likely have a flakey, marginally-functional network device that
  just happens to be generating probes (or probe-looking packets).  Be
especially wary of any Novell IPX things (that often use 802.3 framing).
I would expect more errors that just Probe warnings.

Hope that gives you a starting point, I can't think of any more
specifics.  You said no system changes, but how about network?  Do you
have DTCs?  Do you have DTC Manager?  Those are your likely sources of
probes (legitimate ones anyway).

Jeff

* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *

* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *