From: Mark Newcomb (MNewcomb@xxxxxxxxxxxx)
Date: Thu Dec 27 2001 - 12:32:39 GMT-3
The high traffic by a single workstation is one of the reasons I
advocate the use of an IDS (either Cisco or other manufacturer). Using
a good IDS will instantly show you that the problem is caused by a
workstation.
Just my $0.02 worth.
Mark
-----Original Message-----
From: Aaron T. Hassan [mailto:tyang@attcanada.ca]
Sent: Thursday, December 27, 2001 6:47 AM
To: Anand Ghody; ccielab@groupstudy.com
Subject: Re: Re: OT:Why so high CPU utilization]
We experienced the exactly same problem here and I took the suggestions
from
this forum. Thankful to the guys offered me tips.
First, use process switch as opposed to CEP(I dont know why, something
related to IOS), second, tune your downlink speed/duplex to the same as
the
uplink if your uplink is also Ethernet, if your uplink T1/E1 is 1.5M,
better
to use 10M/half duplex on ur FastEth port.
Did you see the deferred packets on the Fasteth interface? this can
cause
more CPU cycle I guess. It means you push too much from ur LAN to the
WAN
link.
Anyway, after implemented the above changes, my 2620 is at 50% CPU
capacity...which is much better than before..which got 70-80% full.
Also be aware of the activites of virus.... their traffic pattern is
obvious
to tell, much different than normal. The normal operation has more or
less
the same input and output traffic...but with the virus in presence, you
can
see the tremondous in/out traffic and CPU usage just surge up...even
crash
the router, no kidding, this also happened to me at one time....it
turned
out a WINNT running IIS4.0
Good luck
;-).
----- Original Message -----
From: "Anand Ghody" <vze2hq65@verizon.net>
To: <ccielab@groupstudy.com>
Sent: Thursday, December 27, 2001 5:26 AM
Subject: [Fwd: Re: OT:Why so high CPU utilization]
> I'd put a sniffer on the ethernet side and check to see if there are
> any hosts constantly sending to different ip address . This would
cause
> the router to process switch instead of fast switch or whatever. I had
a
> similar problem with a router which connected to an ISP and provided
> internet access for a co-located site for my company. It turned out
> there was some sort of virus on the PCs of a client on one of the
> network segments causing the PCs to shoot out requests constantly to
> different websites which over burdened the routers cpu.
>
>
> Dreams Ruan wrote:
>
> >Hello,Everyone:
> >
> >
> I have a question about router's cpu utilization.My company's router
> >is 2621,used a FE and a Serial port.The data flow about 1.1M/s per
port,
> >and the packet flow about 2800 packets/s per port,but the router's
cpu
> >utilization is 95%!!! I changed a router from 2621 to AS5300,the
AS5300's
> >cpu utilization is 23-35%.The data flow not so high,but Why so high
cpu
> >utilization? The router used static route,no others protocol.
> >
> >!!!!
> >
> >
> >
>
> >!!!!!!!!!!!!!!!!!!!!!!!!!!!!Dreams Ruan
> >!!!!!!!!!!!!!!!!!!!!!!!!!!!!dreams_r@163.com
> >!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!2001-12-25
This archive was generated by hypermail 2.1.4 : Thu Jun 13 2002 - 10:32:48 GMT-3