SNMP bulkwalk intermittently fails with "OID not increasing" for TCP-MIB::tcpListenerProcess

nagagowd

Hello,

I am investigating an SNMP issue observed in a production environment where snmpbulkwalk intermittently fails with the following error:

Error: OID not increasing

TCP-MIB::tcpListenerProcess.ipv4."127.0.0.1".53

This occurs while walking the TCP listener table (.1.3.6.1.2.1.6.20).

Environment:

• OS: AlmaLinux <version>
• Kernel: <uname -r>
• net-snmp: <snmpd -v>

Test setup:

1. Configured SNMP with full MIB access (view all included .1)
2. Generated multiple TCP listeners (via nc and local services)
3. snmpbulkwalk -v2c -c <community> localhost TCP-MIB::tcpListenerProcess

Observed behavior (test environment):

• SNMP walk completes successfully
• Output appears correctly ordered
• Unable to reproduce the error

Observed behavior (production):

• Error: OID not increasing
• Appears to be tied specifically to tcpListenerProcess

Workaround applied:
Excluding the subtree resolves the issue:

view limited included .1.3.6.1.2.1

view limited excluded .1.3.6.1.2.1.6.20

Questions:

1. Under what conditions can tcpListenerProcess return non-monotonic or duplicate OIDs?
2. Is this a known limitation/bug in net-snmp when walking kernel TCP tables?
3. Could this be caused by race conditions while reading /proc/net/tcp or similar kernel interfaces?
4. Are there known kernel versions or high socket churn scenarios that trigger this behavior?
5. Is there a recommended way to reliably reproduce this issue for testing?

Additional notes:

• The issue appears intermittent and environment-specific
• Suspected interaction between SNMP walk timing and dynamic TCP socket state
• Reboot temporarily resolved the issue in production

Any insights into root cause or reproduction strategies would be greatly appreciated.

Thanks.