"Connection Interface Versions Incompatible" error seen in Spectrum VNM.OUT, ARCHMGR.OUT or LOCSERV.OUT files

Products

• Network Observability
• Spectrum

Issue/Introduction

The following "Connection Interface Versions Incompatible" error seen in Spectrum VNM.OUT, ARCHMGR.OUT or LOCSERV.OUT files

Jun 08 18:41:39 ERROR at CsCifFrn.cc(1221): Connection Interface Versions Incompatible
   Version for this applications is: 2 Foreign application does not have a version number.

This can cause the landscapes to fail to connect

Environment

DX NetOps Spectrum any Release

Cause

The message indicates the Spectrum process is receiving connection attempts from processes with incompatible connection protocols.

This issue can arise if you have other, 3rd party tools or processes running, such as port or system scanner or other CORBA based applications that are attempting a connection on the CORBA ports used by Spectrum.

Port 14002 - SpectroSERVER
Port 14003 - Archive Manager
Port 14004 - Location Server

Resolution

This is not a Spectrum product issue. The user needs to identify the application trying to connect to these CORBA ports.

Additional Information

A Tenable Scanner could cause this behavior when probing TCP port 48879 on the SpectroSERVER.

 

Launch the tcpdump via crontab and use the -G and -W parameters to stop tcpdump.

The below command will run the tcpdump for 120 seconds and stop. (60 seconds x 2 = 120 seconds). It will create 2 (-W 2) tcpdump output files with 60 seconds (-G 60) of duration each file.

# tcpdump -i any -s 0 -G 60 -W 2 -w /tmp/myfile-%Y-%m-%d_%H.%M.%S.pcap
dropped privs to tcpdump
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
Maximum file limit reached: 2
1124 packets captured
1755 packets received by filter
0 packets dropped by kernel

Another example (600 seconds x 1 = 600 seconds ==> 10 minutes)(1 output file with 10 minutes of duration):

# tcpdump -i any -s 0 -G 300 -W 1 -w /tmp/myfile-%Y-%m-%d_%H.%M.%S.pcap

For your reference:

https://stackoverflow.com/questions/25731643/how-to-schedule-tcpdump-to-run-for-a-specific-period-of-time

 

Launch TShark via Windows Schedule.

WireShark in Command Line

tshark.exe -D (to list the interfaces)

tshark.exe -i 1 -f "host 10.##.##.##" -w trap.pcap

tshark.exe -i 1 -f "host 10.##.##.##" --autostop duration:60 -w trap.pcap   (autostop after 60 seconds)

 

Open the captured file in WireShark and apply this filter:

ip.dst==10.##.##.## && tcp.dstport==48879 && thrift