The 64 Bit Counter Mystery: Trouble With a HP Procurve Gigabit Switch

Originally published on October 30, 2006 by Dirk Paessler
Last updated on March 03, 2022 • 4 minute read

We had upgraded the last remaining dark and slow 100 Mbit corner of our data center from 100 Mbit Ethernet to Gigabit Ethernet the other day. We installed an HP Procurve 1800-8G which offers Gigabit for 8 ports. As usual we began to monitor this switch using our PRTG software and found quite a surprise: PRTG reported steady peaks of 2.000.000 gigabit/s (2.000 terabit/s). Obviously something went wrong here.

PRTG's lead developer Jens applied some black magic and a packet sniffer to look closer at the problem. He found that it was caused by a bug in the switch firmware. The switch did not talk "standard conform SNMP"!

Tech-Talk: The Problem

SNMP uses ASN.1/BER in order to code the data. So a 64-Bit counter is respectively coded as

  • Byte 1: Type (64-Bit counter)
  • Byte 2: Number of data bytes
  • Byte 3-n: Data bytes

However, the Procurve 1800-8G switch only recognizes one type of "signed" coding. When, for example, the 8th bit of the first data byte (i.e. the highest ranking bit) has a value of 1, the highest ranking element is populated with "FF" bytes. If thereon you have a counter value that is larger than 2147483648 (2^31), i.e. where the highest ranking bit is set, it is necessary to code the whole in 5 Bytes, whereby the highest ranking byte must be set to 0 and the following four normal data bytes follow. In the instance of the Procurve router the device sometimes codes the value in 4 bytes (we did not find a pattern for this) even though the highest ranking bit has been set.

Tech-Talk: The Solution

 

One could, of course, consider one's SNMP library to contain a bug, since negative values are not really in the realm of the possible as regards counters. However, the ASN.1/BER standard does not include unsigned types in binary representation. It would be possible for us to patch our SNMP library in such a manner that the highest ranking Bit could be optionally ignored. This would, nonetheless, mean that it does not work conforming to the standards any more and that may cause new trouble with other devices. So only one solution remains for PRTG users: We recommend to simply use PRTG's 32-Bit counters with the HP Procurve 1800-8G. Another option, of course, would be to contact Hewlett Packard. Maybe they will read this post...

Note: Our switch has software version PA.02.01 and hardware revision R01

Monitoring Insights