Submit a ticketCall us

Don’t fall victim to a ransomware attack
Backups are helpful, but sometimes that’s not enough to protect your business against ransomware. At our live webcast we will discuss how to protect against ransomware attacks with SolarWinds® Patch Manager and how to leverage log data to detect ransomware. Register now for our live webcast.

Home > Success Center > Engineer's ToolSet (ETS) > The Switch Port Mapper show dates last changed in the future

The Switch Port Mapper show dates last changed in the future

Table of contents
Created by Richard Casey, last modified by MindTouch on Jun 23, 2016

Views: 20 Votes: 0 Revisions: 3

Overview

The date last changed reflected in the Switch Port Mapper shows a date in the future.

Environment

All Engineers Toolset versions

Detail

The Switch Port Mapper uses two SNMP oids to calculate the Last change to the operating status of the interface.

 

  • SysUptime (1.3.6.1.2.1.1.3) this is a 32-bit counter that counts up in hundreds of a second from the time the device was booted.
  • ifLastChange (1.3.6.1.2.1.2.2.1.9) a counter value in hundreds of a second since the operating status last change of the interface.

 

To calculate the Last Change value, the iflastchange is deducted from the sysuptime value giving the hundreds of a second since the change. This is compared with the current switch date and time to arrive at the date of the change.

 

A problem occurs when the sysuptime counter rolls over. This occurs every 4,294,967,296 hundreds of a second, and when the iflastchange is deducted from the sysuptime the calculation gives a negative number which results in a date in the future.

 

Rebooting the switch would resolve this by resetting all counters back to zero.

Last modified
19:22, 22 Jun 2016

Tags

Classifications

Public