NetMRI - Possible Routing Loop (Info)

[#1]

We've been seeing the following messages for several of our routers in NetMRI:

"The following devices have experienced a high number of Time Exceeded ICMP messages in the prior 24 hours. High numbers of Time Exceeded ICMP messages are caused by packets that are being discarded due to an expiring TTL. High use of traceroute or routing loops are the typical causes of large number of Time Exceeded ICMP messages."

I'm curious what NetMRI does/uses to determine this - there's nothing we're specifically logging or anything and I'm trying to determine if there is actually a loop. Can anyone provide any insight on how NetMRI sees that there is a possible loop? I'd love to confirm this in some way.

[#2 · Accepted solution]

Well if someone finds this thread looking for the answer, I'm pretty sure it's the results of 'show ip traffic':

ICMP statistics:
Rcvd: 76 format errors, 0 checksum errors, 0 redirects, 292 unreachable
449467 echo, 0 echo reply, 0 mask requests, 0 mask replies, 0 quench
0 parameter, 0 timestamp, 0 info request, 0 other
0 irdp solicitations, 0 irdp advertisements
69 time exceeded, 0 timestamp replies, 0 info replies
Sent: 0 redirects, 1898206 unreachable, 0 echo, 449467 echo reply
0 mask requests, 0 mask replies, 0 quench, 0 timestamp
0 info reply, 522899 time exceeded, 0 parameter problem
0 irdp solicitations, 0 irdp advertisements

This is a sampling of just the ICMP traffic statistics, which we're pretty sure that NetMRI is using to report this.

One way to dig into the traffic further is to use 'debug ip errors', which will show the source/destination of that traffic.