Switching

 View Only
last person joined: yesterday 

Ask questions and share experiences about EX and QFX portfolios and all switching solutions across your data center, campus, and branch locations.
  • 1.  rcp command shows very frequently in messages log. Is this from inside ?

    Posted 10-29-2024 12:46

    I pulled up the messages log on our core switch to troubleshoot another issue and I saw a lot of this:

     rshd[32952]: root@192.168.1.16 as root: cmd='rcp -d -t /var/log/'

    I haven't found a route to that IP range or a known server on our campus.  I haven't found what the -d and -t  parts do yet either.  All the MAN pages I have found don't list them. 

    I'm trying to figure out what would need to transfer info to or from a log file. 



    ------------------------------
    JOHN WILLIAMSON
    ------------------------------


  • 2.  RE: rcp command shows very frequently in messages log. Is this from inside ?

    Posted 10-29-2024 15:14

    This looks to be internal ip address . Its the connectivity from vJunos to linux host. 

    show route table __juniper_private4__.inet.0
     
    __juniper_private4__.inet.0: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)
    + = Active Route, - = Last Active, * = Both
     
    192.168.1.0/24     *[Direct/0] 1w6d 13:13:46
                        >  via em2.32768
    192.168.1.2/32     *[Local/0] 1w6d 13:13:46
                           Local via em2.32768


    ------------------------------
    Jibu Thomas
    ------------------------------



  • 3.  RE: rcp command shows very frequently in messages log. Is this from inside ?

    Posted 10-29-2024 15:25

    I don't have that scope. We just have 192.168.100.0/24 



    ------------------------------
    JOHN WILLIAMSON
    ------------------------------



  • 4.  RE: rcp command shows very frequently in messages log. Is this from inside ?

    Posted 10-29-2024 15:39

    No, I meant its an internal ip address within the box. On some of the platform junos runs on top of linux as a VM. So the connectivity between vJUNOS and linux host is via this internal network. 



    ------------------------------
    Jibu Thomas
    ------------------------------



  • 5.  RE: rcp command shows very frequently in messages log. Is this from inside ?

    Posted 10-29-2024 15:57

    Bingo!

     show route table __juniper_private4__.inet.0

    __juniper_private4__.inet.0: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)
    + = Active Route, - = Last Active, * = Both

    192.168.1.0/24     *[Direct/0] 37w0d 23:21:57
                        >  via em2.32768
    192.168.1.2/32     *[Local/0] 37w0d 23:21:57
                           Local via em2.32768

    So, how do I figure out what "device" in the QFX switch is filling my log with events? 



    ------------------------------
    JOHN WILLIAMSON
    ------------------------------



  • 6.  RE: rcp command shows very frequently in messages log. Is this from inside ?

    Posted 10-30-2024 04:16

    It is the dcpfe, the pfe process that used .16 address. 



    ------------------------------
    Jibu Thomas
    ------------------------------