From: Richard Gallagher (rgallagh@cisco.com)
Date: Wed Jun 08 2005 - 11:05:21 GMT-3
Is the data all coming from the same source? Maybe some kind of attack?
You can dump the packets using "sh buff input <interface> dump" or try
enabling netflow in the ingress interface to see if there are any patterns.
Also the following docs might help you track down the cause of the problem:
- http://www.cisco.com/warp/public/63/highcpu_ip_input.html
- http://www.cisco.com/warp/public/63/ts_codred_worm.shtml
Rich
* Rich Gallagher - Cisco Systems TAC
* CCIE #7211 - R&S, C&S
mmeiers@wi.rr.com wrote:
>IP Input
>
>So everything is being processed switched.
>
>Actually the data is TCP with the control flag marked.
>
>----- Original Message -----
>From: Richard Gallagher <rgallagh@cisco.com>
>Date: Wednesday, June 8, 2005 8:51 am
>Subject: Re: super high CPU on remote router after IOS upgrade on
>distribution side
>
>
>
>>What process is eating the CPU? What does the following show:
>>
>>- sh proc cpu | e 0.00
>>
>>Have you tried the following doc:
>>
>>- http://www.cisco.com/warp/public/63/highcpu.html
>>
>>HTH, Rich
>>
>>* Rich Gallagher - Cisco Systems TAC
>>* CCIE #7211 - R&S, C&S
>>
>>
>>mmeiers@wi.rr.com wrote:
>>
>>
>>
>>>Ok
>>>
>>>So i have a wierd thing going on. Has anyone else had a similar
>>>
>>>
>>issue
>>
>>
>>>or at least maybe an idea of what may be occuring.
>>>
>>>I have a 7206vxr that was running 12.2(24a) connected to a 3660
>>>
>>>
>>running
>>
>>
>>>12.2(10d).
>>> This 3660 is doing a lot of NAT, the CPU of the 3600 is less
>>>
>>>
>>than
>>
>>
>>>30%
>>>
>>>I upgraded the 7206 to 12.3(12b) over the weekend and the remote
>>>
>>>
>>side
>>
>>
>>>routers, which all run 12.2(10d), all started to have CPU
>>>
>>>
>>utilizations
>>
>>
>>>up near 100%.
>>>
>>>If I move the remote side router to a different ditribution
>>>
>>>
>>router that
>>
>>
>>>does not run 12.3 the CPU goes back down to less than 30%
>>>
>>>Thanks
>>>
>>>
>>>
>>_______________________________________________________________________
>>
>>
>>>Subscription information may be found at:
>>>http://www.groupstudy.com/list/CCIELab.html
This archive was generated by hypermail 2.1.4 : Wed Jul 06 2005 - 14:43:41 GMT-3