[nsp] High CPU due to IP Input : Too many ACK, PSH
Mehmet Ali Suzen
msuzen at mail.north-cyprus.net
Wed Mar 17 02:08:17 EST 2004
Dear List,
I am trying to figure out how to reduce IP load on a border router.
(Cisco 2511) running IoS 12.1
After having look out Cisco docs about CPU utilization.
http://www.cisco.com/warp/public/63/highcpu_processes.html
http://www.cisco.com/warp/public/63/highcpu_ip_input.html
So I have apply some of them includig ip route-cache and
ip route-cache flow on the interfaces. Below is the
sample ip debug session output. I am wondering why
we are getting to many ACK/ ACK PSH and forward packets.
Pattern is similar in high cpu state.
I wrote a simple perl script that checks CPU load and IP load and
sends packet detail if level is above the treshold.
In my case it is if cpu load is more then 70% and IP
Input 25%.
Best Regards,
Mehmet
--------------------------------------------------------------------------------------------------
#debug ip packet details
#undebug all
All possible debugging has been turned off
#show logging
Syslog logging: enabled (240748 messages dropped, 0 flushes, 0 overruns)
Console logging: disabled
Monitor logging: disabled
Buffer logging: level debugging, 2968625 messages logged
Trap logging: level informational, 20100 message lines logged
Logging to 112.210.247.3, 20100 message lines logged
Log Buffer (4096 bytes):
1.142 (Ethernet0), d=80.24.198.89 (Serial0.1), g=80.24.198.89, len 48, forward
3w0d: TCP src=3123, dst=1737, seq=2850726810, ack=0, win=8160 SYN
3w0d: IP: s= 112.210.247.142 (Ethernet0), d=62.167.49.130 (Serial0.1), g=62.167.49.130, len 48, forward
3w0d: TCP src=3124, dst=1214, seq=2850788635, ack=0, win=8160 SYN
3w0d: IP: s=112.210.247.4 (Ethernet0), d=198.41.0.4 (Serial0.1), g=198.41.0.4, len 67, forward
3w0d: UDP src=1024, dst=53
3w0d: IP: s=112.210.247.142 (Ethernet0), d=62.163.157.126 (Serial0.1), g=62.163.157.126, len 48, forward
3w0d: TCP src=3127, dst=3324, seq=2850929011, ack=0, win=8160 SYN
3w0d: IP: s=212.98.228.212 (Ethernet0), d=112.210.247.133 (Ethernet0), g=112.210.247.133, len 576, forward
3w0d: TCP src=80, dst=1192, seq=2916234572, ack=1063454, win=32696 ACK PSH
3w0d: IP: s=112.210.247.142 (Ethernet0), d=80.200.31.83 (Serial0.1), g=80.200.31.83, len 48, forward
3w0d: TCP src=3125, dst=2684, seq=2850836739, ack=0, win=8160 SYN
3w0d: IP: s=112.210.247.142 (Ethernet0), d=212.186.179.43 (Serial0.1), g=212.186.179.43, len 48, forward
3w0d: TCP src=3126, dst=3152, seq=2850881134, ack=0, win=8160 SYN
3w0d: IP: s=112.210.247.1 (local), d=112.210.247.3 (Ethernet0), len 41, sending
3w0d: TCP src=23, dst=54498, seq=1542305889, ack=2807551189, win=64955 ACK PSH
3w0d: IP: s=112.210.247.5 (Ethernet0), d=112.210.247.127, len 532, rcvd 0
3w0d: UDP src=520, dst=520
3w0d: IP: s=112.210.247.5 (Ethernet0), d=112.210.247.127, len 412, rcvd 0
3w0d: UDP src=520, dst=520
3w0d: IP: s=128.242.99.116 (Serial0.1), d=112.210.247.4 (Ethernet0), g=112.210.247.4, len 40, forward
3w0d: TCP src=80, dst=40115, seq=1413947636, ack=2868368361, win=64771 ACK FIN
3w0d: IP: s=112.210.247.1 (local), d=112.210.247.3 (Ethernet0), len 41, sending
3w0d: TCP src=23, dst=54498, seq=1542305890, ack=2807551189, win=64955 ACK PSH
3w0d: IP: s=62.167.49.130 (Serial0.1), d=112.210.247.142 (Ethernet0), g=112.210.247.142, len 40, forward
3w0d: TCP src=1214, dst=3124, seq=0, ack=2850788636, win=0 ACK RST
3w0d: IP: s=112.210.247.3 (Ethernet0), d=112.210.247.1 (Ethernet0), len 40, rcvd 3
3w0d: TCP src=54498, dst=23, seq=2807551192, ack=1542305891, win=16800 ACK
3w0d: IP: s=112.210.247.1 (local), d=112.210.247.3 (Ethernet0), len 41, sending
3w0d: TCP src=23, dst=54498, seq=1542305891, ack=2807551189, win=64955 ACK PSH
3w0d: IP: s=63.166.177.3 (Serial0.1), d=112.210.247.19 (Ethernet0), g=112.210.247.19, len 44, forward
3w0d: TCP src=30063, dst=6366, seq=1043775969, ack=0, win=8192 SYN
3w0d: IP: s=112.210.247.4 (Ethernet0), d=112.210.247.130 (Ethernet0), g=112.210.247.130, len 69, forward
3w0d: UDP src=53, dst=1200
3w0d: IP: s=112.210.247.3 (Ethernet0), d=112.210.247.1 (Ethernet0), len 40, rcvd 3
3w0d: TCP src=54498, dst=23, seq=2807551192, ack=1542305892, win=16800 ACK
3w0d: IP: s=80.24.198.89 (Serial0.1), d=112.210.247.142 (Ethernet0), g=112.210.247.142, len 40, forward
3w0d: TCP src=1737, dst=3123, seq=0, ack=2850726811, win=0 ACK RST
3w0d: IP: s=216.66.74.145 (Ethernet0), d=112.210.247.152 (Ethernet0), g=112.210.247.152, len 1500, forward
3w0d: TCP src=80, dst=3194, seq=3069413179, ack=4116886453, win=32120 ACK
3w0d: IP: s=216.66.74.145 (Ethernet0), d=112.210.247.152 (Ethernet0), g=112.210.247.152, len 1025, forward
3w0d: TCP src=80, dst=3194, seq=3069414639, ack=4116886453, win=32120 ACK PSH
3w0d: IP: s=112.210.247.19 (Ethernet0), d=63.166.177.3 (Serial0.1), g=63.166.177.3, len 40, forward
3w0d: TCP src=6366, dst=30063, seq=0, ack=1043775970, win=0 ACK RST
3w0d: IP: s=62.163.157.126 (Serial0.1), d=112.210.247.142 (Ethernet0), g=112.210.247.142, len 48, forward
3w0d: TCP src=3324, dst=3127, seq=1341870215, ack=2850929012, win=17680 ACK SYN
3w0d: IP: s=80.200.31.83 (Serial0.1), d=112.210.247.142 (Ethernet0), g=112.210.247.142, len 40, forward
3w0d: TCP src=2684, dst=3125, seq=0, ack=2850836740, win=0 ACK RST
3w0d: IP: s=112.210.247.1 (local), d=112.210.247.3 (Ethernet0), len 42, sending
3w0d: TCP src=23, dst=54498, seq=1542305892, ack=2807551189, win=64955 ACK PSH
--------------------------------------------------------------------------------------------------
More information about the cisco-nsp
mailing list