Network Management / (OpenView-NNM) Practitioners Forum

Alarm Browser Events Question

Tom Hessick
Frequent Contributor.

Alarm Browser Events Question

I have two Alarm browser events that recur continously.

1. Major Alarm, SNMP is reporting a different mac address than reported by other network devices for most switches. OV_PhysAddr_Mismatch.

2. Major Alarm, Duplicate IP addresses for many hubs and switches. is conflicting on most devices even though the SLIP fields have been cleared.

What is the correct way to stop these messages?

Berlene Herren
Acclaimed Contributor.

Re: Alarm Browser Events Question

Tom, This event is generated by HP OpenView when it detects a suspect physical address (sometimes called MAC address or link level address) on a node. This happens when the
physical address from node2's ARP cache is different than what node1 returned via SNMP. The physical address from node2 is discarded.

This could be caused by a stale ARP cache entry, if node1's physical address recently changed. However, if the physical address on node1 has not changed due to a change in
node1's physical address (such as interface card replaced or machine upgraded), this could represent a duplicate IP address, so this event should be closely watched.

The ARP cache on node2 could be different because nodeX is also using node1's IP address, and node2 has most recently talked to nodeX.

To get more information, two nodes need to be queried. The first node is the node which reported a different physical address. This information was retrieved from the first node's ARP cache.

The other part of the information needed is to get the physical address for the node in question. This information was retrieved from the second node's IfPhysAddress.

The first part of the information needed (ARP Cache) can be retrieved by selecting the first node then using the menuitem:
Configuration:Network Configuration->ARP Cache
or the TTY command:
It can also be determined by selecting
from the MIB browser and SNMP walking the first node. These will all return the ARP Cache. You must find the entry
which corresponds to the second node.

The second part of the information needed (physical address)
can be retrieved using the menu item:
Configuration:Network Configuration->Addresses
or the TTY command:
It can also be determined by selecting
from the MIB browser and SNMP walking the second node.

If there truly is a mismatch, it can be caused by one node using the same IP address as another. The message may also
indicate that an IP address is using two different physical addresses. This happens when the IP address of a node changes because that node has changed subnets. Yet another problem comes from older HP X-Terminal firmware which incorrectly reported an ifPhysAddress of 00 00 00 00 00 00.

Typically, several nodes will report this mismatch during ademand poll operation, or as they do their daily configuration