HP Procurve 8000M switch error ???

[John Sainato]

I have 12 HP Procurve 8000M switches running firmware C.09.16.
Lately I have been receiving the following error message in the log.
This happened shortly after we were hit with a strain of the Welchia
or Nachi virus. Could this be related and if so does anyone know the
best way for me to find the source? We do scan the network however we
are not finding anything.

W 01/28/90 00:18:24 tftp: SENT error:1, msg: File not found
W 01/28/90 00:18:28 tftp: SENT error:1, msg: File not found
W 01/28/90 00:18:28 tftp: SENT error:1, msg: File not found
W 01/28/90 00:18:33 tftp: SENT error:1, msg: File not found
W 01/28/90 00:18:33 tftp: SENT error:1, msg: File not found

Thank You

John

[eirram]

Hello John,

What your switch is saying, is that someone is trying to get a file
from the switch itself. Either the file does not exist, or the name is
incorrect. Most likely the requested file does not exists.

The hard work is that there is no IP address associated to this error
message, so you'll have to find out who is the offending node that is
polling the switch.

My best guess is that there is still an (portable) infected computer
that tries to get something from the 8000M.

What I would like to recommend is to sniff the traffic and look for
tftp transaction to the switch's IP.

Hope this helps.

On 24 Sep 2003 05:12:54 -0700, john@sainato.net (John Sainato) wrote:
I have 12 HP Procurve 8000M switches running firmware C.09.16.Lately I have been receiving the following error message in the log.This happened shortly after we were hit with a strain of the Welchiaor Nachi virus. Could this be related and if so does anyone know thebest way for me to find the source? We do scan the network however weare not finding anything.W 01/28/90 00:18:24 tftp: SENT error:1, msg: File not foundW 01/28/90 00:18:28 tftp: SENT error:1, msg: File not foundW 01/28/90 00:18:28 tftp: SENT error:1, msg: File not foundW 01/28/90 00:18:33 tftp: SENT error:1, msg: File not foundW 01/28/90 00:18:33 tftp: SENT error:1, msg: File not foundThank YouJohn