Home Services Software Second-Hand Shop Specials Deutsch English           
Support General Information Sitemap Search           

Bitshift Support

Help from competent people

Bitshift, Berchtold IT Solutions
Fehler: Navigationsleiste kann nicht angezeigt werden.

How to resolve the "Warning: Cookie information is corrupt" error on Cisco routers

 Table of contents

 Article summary

Most Cisco routers contain an EEPROM. It holds essential information which is unique to the device, such as the processor board ID or the Ethernet MAC address. This information is read by the bootstrap when the router is powered on or reloaded.

Under certain circumstances, the EEPROM can get erased. If that happens, the router is unable to boot and thus is rendered unusable.

This article describes how this issue can be resolved.

Please notice that if you have a service contract for your router, it may be a better solution to have the device replaced, since that's what a service contract is for.

You have to be familiar with hexadecimal numbers to proceed successfully.

Back to top

 Products to which this information applies

All information in this article applies to Cisco routers of the following series:

  • 826, 827, 828, 836, 837

  • SOHO77

Although it is possible that some or all of the information in this article also applies to routers of other families, this has not been tested an thus cannot be guaranteed.
It clearly does NOT apply to devices of the following series:

  • 2500

Back to top

 What a cookie is

The cookie is a data structure stored in an EEPROM. It contains information about the router hardware and is programmed during manufacturing of the device. Some of the information contained in the cookie is unique to each router. That's why it is not stored in ROM.

Back to top

 How to display the cookie

To display the current cookie, boot the router and enter rommon mode by pressing the break key sequence. Click here for more information on valid break key sequences.
You should see output similar to the following:

System Bootstrap, Version 12.2(4r)XM1, RELEASE SOFTWARE (fc1)
TAC Support: http://www.cisco.com/tac
Copyright (c) 2001 by cisco Systems, Inc.
C800/SOHO series (Board ID: 13-62) platform with 32768 Kbytes of main memory

rommon 1 >

Type "cookie" and press enter. The router should display its current cookie, similar to the following:

rommon 1 > cookie

cookie:
01 01 00 04 27 fe 00 ea 3e 00 01 ff 01 ff 00 00
00 00 00 00 00 00 00 00 4a 41 42 01 02 41 42 43
44 04 01 00 00 00 00 00 00 ff ff ff 50 04 49 11
ec 03 ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
rommon 2 >

On IOS 12.2(8)T (may depend on the platform, maybe not implemented on 800 series routers), you can also issue a "show diag" exec mode command to show the cookie contents. This will also show you the cookie contents of any daughter card or module, if any.

Back to top

 How to find out that a cookie is corrupt

If the cookie of a router is corrupt, it is almost everytime set to all zeros.
Your router may be still working after the cookie has been corrupted. However it is unable to boot. So if you reload or power-cycle the router, it won't come up any more. Instead it goes to rommon mode after displaying something like this:

System Bootstrap, Version 12.2(4r)XM1, RELEASE SOFTWARE (fc1)
TAC Support: http://www.cisco.com/tac
Copyright (c) 2001 by cisco Systems, Inc.
WARNING: Cookie information is corrupt
C800/SOHO series (Board ID: 13-0) platform with 32768 Kbytes of main
memory

loadprog: error - Invalid image for platform
e_machine = 62, cpu_type = 0
boot: cannot load "flash:"
System Bootstrap, Version 12.2(4r)XM1, RELEASE SOFTWARE (fc1)
TAC Support: http://www.cisco.com/tac
Copyright (c) 2001 by cisco Systems, Inc.
WARNING: Cookie information is corrupt
C800/SOHO series (Board ID: 13-0) platform with 32768 Kbytes of main
memory

loadprog: error - Invalid image for platform
e_machine = 62, cpu_type = 0
boot: cannot load "flash:"

System Bootstrap, Version 12.2(4r)XM1, RELEASE SOFTWARE (fc1)
TAC Support: http://www.cisco.com/tac
Copyright (c) 2001 by cisco Systems, Inc.
WARNING: Cookie information is corrupt
C800/SOHO series (Board ID: 13-0) platform with 32768 Kbytes of main
memory

rommon 1 >

Back to top

 Cookie data structure

The cookie consists of 128 bytes of data. It is normally displayed in hexadecimal form, 8 rows of 16 bytes.

Each byte has a specific meaning. See the following table:

Byte index Size in bytes Name Description
0x00 1 Version Not 100% clear. Maybe this is the version of the cookie format.
0x01 1 Vendor The vendor of the device. It is assumed that this value is always 0x01, as the vendor is always Cisco.
0x02 6 Ethernet HW Address The MAC address (bia) of the first integrated Ethernet interface.
0x08 1 Processor This is the processor type.
This value is sometimes referred to as "e_machine".
Some routers also display a "Board ID" (such as "Board ID: 13-62") during boot, where the second of the two numbers is identical to "CPU Type", but is notated in decimal instead of hex.
0x09 1 NVRAM Size Size index of the NVRAM.
This value is NOT the size in KBytes or similar.
0x0a 1 CPU Speed The speed index of the CPU.
This value is NOT the speed in MHz or similar.
0x0b 1 Unused -
0x0c 2 On-board PM ID It is not currently known what this is exactly.
0x0e 2 MAC Address Allocated It is not currently known what this is exactly.
0x10 8 Unknown -
0x18 9 Processor board ID This is the encoded processor board ID, which is printed on a label on the mainboard of the router.
The processor board ID is NOT identical with the serial number of the device.
0x21 2 CPU Revision This value is sometimes referred to as the "Processor Revision".
0x23 2 Deviation This value is sometimes referred to as the "Hardware Revision" or just "HW Revision".
0x25 7 Unknown -
0x2c 1 CPU Type This is the type of CPU.
This value is sometimes referred to as "cpu_type".
0x2d 1 Board Config It is not currently known what this is exactly.
0x2e 4 Unknown -
0x32 6 WAN MAC Address Not 100% clear. Maybe this is the MAC bia address of the second (WAN-side) Ethernet interface on some models (e.g. 1710 router).
0x38 72 Unused -

As you can see, the meaning of some of the values is still unclear or even totally unknown. But nevertheless there is a good chance to repair a corrupt cookie by simply making some good guesses.

Back to top

 Recreating cookie values

Still working on this...

 

Before you can reprogram the cookie, you have to create a list of values.

 Version

It is assumed that this value is always 0x01. No other values have ever been seen.

Back to top

 Vendor

It is assumed that this value is always 0x01, as the vendor is always Cisco. No other values have ever been seen.

Back to top

 Ethernet HW Address

The router always uses this value as the MAC address of it's first Ethernet interface. So it seems essential to have the valid MAC address at hand, or at least one that doesn't impose any problems.

Restoring the original MAC address of the router may be a bit tricky - not to say impossible - since it is not printed on any label on the router, and there is no way to derive it from some serial number or similar.

Try all possible sources that are available to find out what MAC address the router once had, such as:

  • if you are very fast: the arp cache of some other devices; but this chance is minimal since normal arp cache timeouts are around minutes.

  • your documentation; maybe you have documented the MAC address somewhere.

  • your element management system, such as CiscoWorks 2000 RME.

  • your asset management system, such as QIP.

  • your network management system, such as HP OpenView NNM or Tivoli; those tools always have the MAC addresses of all nodes in their database.

  • your NAI ePO Server's "Rogue System Sensor".

  • some network traces; maybe you have used your network sniffer tool and have saved data to files. These files may contain the MAC address of your router.

  • any syslogs / snmp traps or messages / e-mails that may contain the MAC address of your router.

  • whatever you may find...

If none of that helps you and you really are unable to find it out, you must make a good guess.
When guessing a MAC address, the most important thing is not to use a MAC address you have seen on any other device. If you do that and those two devices are - by some strange coincidence - once connected to the same Ethernet segment, then you will confronted with one of the most boring network problems that can ever arise. Ethernet simply does not work if two devices have the same MAC address, and it is very hard to identify this problem.
The best way is to visit the official IEEE MAC address vendor code list, scrolling down to a random position in this really large text file, and then starting a search for "cisco" from that position. Use the first match and add random bytes until you have a six-byte value. This should be a suitable MAC address, since the chance that you are conflicting with an existing device is less than, say, one to a million.

Back to top

 Processor

This is very simple, since a router with a corrupt cookie prints this value onto the console when it is powered on, at least as long as there is a valid image file in flash.

Take a look at the following output fragment taken from above:

loadprog: error - Invalid image for platform
e_machine = 62, cpu_type = 0

The term "e_machine" is a alias for the processor type. All you have to do is convert this decimal value to a hex number.

By the way: This is the actual reason why the router won't boot when the cookie is corrupt. At boot time, the router compares the e_machine value found in the cookie with the e_machine value found in the image file in flash. If these two values do not match, the router assumes that this image file is not valid for it's own platform, and refuses to load it.

Back to top

 NVRAM Size

This value defines the amount of NVRAM available.

The only value that has been seen so far is 0x00 which means a NVRAM size of 256KBytes.

Do NOT enter the size of your NVRAM in KBytes or such.

Back to top

 CPU Speed

This value obviously defines the CPU clock rate.

The only value that has been seen so far is 0x00 which means a CPU speed of 50MHz.

Do NOT enter the CPU speed in MHz or such.

Back to top

 On-board PM ID

Unfortunately it is not yet known what the meaning of that is.

Different values have been found so far.

We are currently working on that.

Back to top

 MAC Address Allocated

Unfortunately it is not yet known what the meaning of that is.

The only value that has been seen so far is 0x00.

We are currently working on that.

Back to top

 Processor Board ID

This is the hex-encoded id of the processor board. This number, which is NOT identical to the serial number of the router, is printed on a label on the mainboard and should look like JAB0123A4B5 (most of them start with JA or FO). Thus you will have to open the chassis.

To hex-encode it, you will need an ASCII characters table. Do the following:

  1. Convert the ASCII value of the first three characters to hex.
    This will give you octets 0x18, 0x19 and 0x1a.

  2. Add the next four numbers pair-wise as they appear in the id.
    These are octets 0x1b and 0x1c.

  3. Convert the ASCII value of the last four characters to hex. Those may contain number characters as well (as opposed to the first three), which must be treated as letters, not numbers.
    These are octets 0x1d through 0x20.

The result should be a chain of seven octets.

Let's do that on the above example (JAB0123A4B5), just for clarification:

  1. The ASCII values of the three letters "JAC" are (in hex): 0x4a, 0x41, 0x43.

  2. The next four numbers are 0123, so you add 0x01 and 0x23.

  3. The ASCII values of the four letters "A4B5" are (in hex:) 0x41, 0x34, 0x42, 0x35.

The result is 0x4a 0x41 0x43 0x01 0x23 0x41 0x34 0x42 0x35. This is the hex-encoding of "JAC0123A4B5".

Back to top

 CPU revision

This two-byte value obviously defines the CPU revision number.

Different values been seen so far. We will report later on this.

Back to top

 More to come

Descriptions of other cookie values will follow soon...

Back to top

 Reprogramming the cookie

If you are sure your cookie values list is as accurate as needed, boot the router and go to "priv" rommon mode. Click here to find out how to do this.

If you are in "priv" rommon mode, type "cookie" and press Enter. The router starts interviewing you. Briefly enter one after another all values from your list. This should look like that:

rommon 2 > cookie

View/alter bytes of serial cookie by field --
Input hex byte(s) or: CR -> skip field; ? -> list values
byte 0x00 - Version: 00
                   > 01

byte 0x01 - Vendor (Recommended Value: 0x01): 00
                                            > 01

bytes 0x02-0x07 - Ethernet HW Address: 00 00 00 00 00 00
                                     > 00 b0 c2 8d c9 6f

byte 0x08-0x08 - Processor (Recommended Value: 0x3e): 00
                                                    > 3e

byte 0x09-0x09 - NVRAM Size (Recommended Values: 256K - 0x00): 00
                                                             > 00

byte 0x0a-0x0a - CPU Speed (Recommended Value: 50Mhz - 0x01): 00
                                                            > 01

byte 0x0b-0x0b - Unused: 00
                       > ff

bytes 0x0c-0x0d - On-board PM ID: 00 00
                                > 01 ff

bytes 0x0e-0x0f - MAC Address Allocated: 00 00
                                       > 00 00

bytes 0x10-0x17: 00 00 00 00 00 00 00 00
               > 00 00 00 00 00 00 00 00

bytes 0x18-0x22: 00 00 00 00 00 00 00 00 00 00 00
               > 4a 41 44 06 15 30 34 48 48 04 01

bytes 0x23-0x24 - Deviation: 00 00
                           > 00 00

bytes 0x25-0x2c: 00 00 00 00 00 00 00 00
               > 00 00 00 00 ff ff ff 50

bytes 0x2d-0x2d - Board Config: 00
                              > 04

bytes 0x2e-0x31: 00 00 00 00
               > 49 11 ec 03

bytes 0x32-0x37 - WAN MAC Address: 00 00 00 00 00 00
                                 > ff ff ff ff ff ff

bytes 0x38-0x3f: 00 00 00 00 00 00 00 00
               > ff ff ff ff ff ff ff ff

bytes 0x40-0x47: 00 00 00 00 00 00 00 00
               > ff ff ff ff ff ff ff ff

bytes 0x48-0x4f: 00 00 00 00 00 00 00 00
               > ff ff ff ff ff ff ff ff

bytes 0x50-0x57: 00 00 00 00 00 00 00 00
               > ff ff ff ff ff ff ff ff

bytes 0x58-0x5f: 00 00 00 00 00 00 00 00
               > ff ff ff ff ff ff ff ff

bytes 0x60-0x67: 00 00 00 00 00 00 00 00
               > ff ff ff ff ff ff ff ff

bytes 0x68-0x6f: 00 00 00 00 00 00 00 00
               > ff ff ff ff ff ff ff ff

bytes 0x70-0x77: 00 00 00 00 00 00 00 00
               > ff ff ff ff ff ff ff ff

bytes 0x78-0x7f: 00 00 00 00 00 00 00 00
               > ff ff ff ff ff ff ff ff
rommon 3 >

Now your cookie has been reprogrammed. Try to boot the router by entering "b" and pressing enter. If the router successfully boots, you are almost finished. If not, some of the values you chose may be wrong, or you may have mistyped some when entering them into the router. Don't give up, just give it another try.

Back to top

 Test the router

Before using the router again in a production environment, you should thoroughly test it.

The simplest tests are the following:

  • Use "show version" to check if the Processor Board ID is correct.

  • Use "show interface ..." to check if the first ethernet interface's MAC address is correct.

  • Run simple IP tests (ping etc.)

  • Let the router run at least some hours with a console attached, then check for eventual messages or reboots / crashes.

If the router passes all tests, you're finished.

Back to top

 Article information

Current revision

Article ID BSKB-000001
Revision 0.3
Last modification 12/30/07 16:20:40 +0100
Keywords cisco router cookie corrupt prom eprom eeprom resolve repair boot

Revision history

Revision Changes
  0.3 Added reference to "show diag"
  0.2 Some minor additions
0.1 Initial pre-release

Related articles

ID Title
BSKB-000002 How to enter the password protected "priv" rommon mode on cisco routers

Disclaimer: The information in this article is provided "as is". Use of this information is at your own risk. Bitshift cannot be made responsible for any damage or financial loss that arises from using information from this article.

Back to top

Sitemap - Search - AGB - AUP  2013 Bitshift, Berchtold IT Solutions. This information is subject to change without notice. This page and all content as well as any embedded code are protected by international laws. Any reproduction of all or parts without permission is strictly prohibited.