The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
ONS 15327, ONS 15454, ONS 15454 SDH
A file descriptor leak can occur in Cisco ONS 15454, ONS 15454 SDH and ONS 15327 software Releases 4.0, 4.0.1 and 4.1.
File descriptors are the operating system resource used for communicating information between internal tasks, writing and reading to files on the flash memory, and sending and receiving data over the external LAN. There are a finite number of available file descriptors, and exhaustion of these resources will have severe effects.
In the listed releases, a file descriptor leak can occur if a SOCKS proxy connection to the Network Element (NE) fails to establish properly. The SOCKS proxy server on the NE is used by Cisco Transport Controller (CTC) so that a Gateway Network Element (GNE) can provide SOCKS services for management traffic for an End-Point Network Element (ENE) for which it is acting as a firewall. To this end, the proxy server listens for new connections on TCP port 1080.
By default, a CTC session connected to an NE polls the SOCKS proxy server every minute, with a five second timeout, to determine if there are any new ENEs for which the NE is acting as a firewall. Note: This occurs even if the SOCKS proxy feature is not enabled.
Any failure of the once-a-minute polls, including a timeout, causes a file descriptor to be leaked on the NE. The chances of a SOCKS proxy poll failing to an NE on a well-maintained network are low, but on a congested or misconfigured network the chances are greater.
When file descriptors are at or near exhaustion on an NE there are several indicators:
The active Timing Communications and Control Card (TCC) might spontaneously reset.
CTC manageability might be lost.
New CTC, Cisco Transport Manager (CTM), or Transaction Language 1 (TL1) connections might fail to become established.
Database backup or retrieval might fail.
Reset or newly inserted cards might fail to boot up.
The Standby Database Out of Sync (DBOOS) alarm might be present.
If this issue is determined to be present, there are two steps that can be taken:
Investigate the network to understand why the polls of the SOCKS proxy are failing, as this is likely a symptom of a network issue.
Stop CTC and CTM from polling the SOCKS proxy on the NE. Note that changing CTC and CTM to stop using the proxy will prevent management of any ENEs, so this workaround is not usable if you need to use the proxy on GNEs.
Close the CTC session. CTC must not be running when updating CTC.ini.
Access the profile directory: Right-click on the start button, left-click on Explore, and then click on the "Up" folder on the Explorer toolbar. You will see the CTC.ini file.
Double-click and edit the file.
Add the line: ctc.firewall.enable=false
Edit the /opt/CiscoTransportManagerServer/CTC.ini file on the CTM server computer, and add the line: ctc.firewall.enable=false.
Restart the CTM server so that it re-reads this file.
On UNIX clients, edit /opt/CiscoTransportMangerClient/cms/.ctcrc and add the same line.
On Windows clients, edit C:\CiscoTransportManagerClient4_1\cms\cms.ini and add the same line.
To follow the bug ID link below and see detailed bug information, you must be a registered user and you must be logged in.
CSCec17406 (registered customers only)
TCC and Entire node reboots on attacking port 1080
If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:
Product Alert Tool - Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.