[nsp] High CPU utilization from traffic with no destination i nterface?

rpcbind at speakeasy.net rpcbind at speakeasy.net
Thu Jun 26 15:06:46 EDT 2003


Nothing sticks out there that would disable cef, but I'd double-check 
access-list 101 and check to see if the perhaps the version you're running 
can't cef-switch NAT (I believe this showed up in 12.2T).

On Thu, 26 Jun 2003, Temkin, David wrote:

> As you see, we have unreachables turned off...  If I do a show ip cef on the
> non-existant network, it shows it as via the default route on the box, which
> is right back out the interface it came in on..
> 
> Now that the attack has stopped, CPU is back to it's normal ~30%...  
> 
> FastEthernet0/0 is up, line protocol is up
>   Internet address is x.x.x.x
>   Broadcast address is 255.255.255.255
>   Address determined by non-volatile memory
>   MTU is 1500 bytes
>   Helper address is not set
>   Directed broadcast forwarding is disabled
>   Secondary address 209.213.219.91/29
>   Outgoing access list is not set
>   Inbound  access list is 101
>   Proxy ARP is enabled
>   Security level is default
>   Split horizon is enabled
>   ICMP redirects are always sent
>   ICMP unreachables are never sent
>   ICMP mask replies are never sent
>   IP fast switching is enabled
>   IP fast switching on the same interface is enabled
>   IP Flow switching is enabled
>   IP CEF switching is enabled
>   IP CEF Flow Fast switching turbo vector
>   IP multicast fast switching is enabled
>   IP multicast distributed fast switching is disabled
>   IP route-cache flags are Fast, Flow, CEF
>   Router Discovery is disabled
>   IP output packet accounting is disabled
>   IP access violation accounting is disabled
>   TCP/IP header compression is disabled
>   RTP/IP header compression is disabled
>   Probe proxy name replies are disabled
>   Policy routing is disabled
>   Network address translation is enabled, interface in domain outside
>   WCCP Redirect outbound is disabled
>   WCCP Redirect inbound is disabled
>   WCCP Redirect exclude is disabled
>   BGP Policy Mapping is disabled
>   IP multicast multilayer switching is disabled
> 
> -----Original Message-----
> From: rpcbind at speakeasy.net [mailto:rpcbind at speakeasy.net] 
> Sent: Thursday, June 26, 2003 2:50 PM
> To: Temkin, David
> Cc: cisco-nsp at puck.nether.net
> Subject: RE: [nsp] High CPU utilization from traffic with no destination i
> nterface?
> 
> 
> 
> Ejay made the point that I overlooked -- make sure that you have 'no ip 
> unreach' on the ingress interface, otherwise you'll end up generating a pile
> 
> of icmp (though IIRC, this is ratelimited).
> 
> > There is no null interface because there's nothing statically routed 
> > that
> > way for it...
> 
> There is, irregardless of whether you configured it, ie:
> 
> sw-core3>show ip cef 70.12.0.0
> 0.0.0.0/0, version 371298, epoch 0, attached
> 0 packets, 0 bytes
>   via Null0, 0 dependencies
>     valid null adjacency
> 
> > Yup, I am running CEF...
> >
> > Show int switching shows that it's all being process switched.
> 
> This is inevitably the true root of your problem -- if CEF is enabled 
> globally, and you don't have a 'no ip route-cache cef' on the interface,
> then 
> 'sho ip int' should reveal something nasty that's forcing process switching.
> 
> Which platform and what type of interfaces are you seeing this on? If
> everything's being processed switched, then your baseline CPU is going to be
> much higher than if should be.
> 
> 
> > -----Original Message-----
> > From: rpcbind at speakeasy.net [mailto:rpcbind at speakeasy.net]
> > Sent: Thursday, June 26, 2003 2:35 PM
> > To: Temkin, David
> > Cc: cisco-nsp at puck.nether.net
> > Subject: Re: [nsp] High CPU utilization from traffic with no destination
> > interface?
> > 
> > 
> > 
> > Are you running CEF? If so, then there's an implicit adjaceny to the 
> > null
> > interface, so it should be handled extremely inexpensively. What does a
> > 'show 
> > ip int' of the ingress interface show -- any chance there's some features 
> > there that may have tickled things badly?
> > 
> > 
> > On Thu, 26 Jun 2003, Temkin, David wrote:
> > 
> > > Does anyone know the actual IOS architecture for handling packets 
> > > that
> > > enter the router where the router doesn't have a route for them?
> > > 
> > > I had a situation where a large amount of traffic was directed at 
> > > one
> > > of my routers that didn't have a route to the destination and the CPU 
> > > was pegged at 99%...  When I added an ACL blocking traffic to the 
> > > networks that I didn't have routes to, the utilization dropped 
> > > dramatically.
> > > 
> > > Thanks,
> > > 
> > > -Dave
> > > 
> > > 
> > > David Temkin
> > > S-I-G
> > > 401 City Avenue
> > > Bala Cynwyd, PA 19004
> > > http://www.sig.com <http://www.sig.com>
> > > 
> > > 
> > > 
> > > IMPORTANT:The information contained in this email and/or its
> > > attachments is confidential. If you are not the intended recipient, 
> > > please notify the sender immediately by reply and immediately delete 
> > > this message and all its attachments.  Any review, use, reproduction, 
> > > disclosure or dissemination of this message or any attachment by an 
> > > unintended recipient is strictly prohibited.  Neither this message nor 
> > > any attachment is intended as or should be construed as an offer, 
> > > solicitation or recommendation to buy or sell any security or other 
> > > financial instrument.  Neither the sender, his or her employer nor any 
> > > of their respective affiliates makes any warranties as to the 
> > > completeness or accuracy of any of the information contained herein or 
> > > that this message or any of its attachments is free of viruses.
> > > 
> > > 
> > > _______________________________________________
> > > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > > http://puck.nether.net/mailman/listinfo/cisco-nsp
> > > archive at http://puck.nether.net/pipermail/cisco-nsp/
> > > 
> > 
> > 
> > IMPORTANT:The information contained in this email and/or its 
> > attachments is confidential. If you are not the intended recipient, 
> > please notify the sender immediately by reply and immediately delete 
> > this message and all its attachments.  Any review, use, reproduction, 
> > disclosure or dissemination of this message or any attachment by an 
> > unintended recipient is strictly prohibited.  Neither this message nor 
> > any attachment is intended as or should be construed as an offer, 
> > solicitation or recommendation to buy or sell any security or other 
> > financial instrument.  Neither the sender, his or her employer nor any 
> > of their respective affiliates makes any warranties as to the 
> > completeness or accuracy of any of the information contained herein or 
> > that this message or any of its attachments is free of viruses.
> > 
> > 
> > 
> 
> 
> IMPORTANT:The information contained in this email and/or its attachments is
> confidential. If you are not the intended recipient, please notify the
> sender immediately by reply and immediately delete this message and all its
> attachments.  Any review, use, reproduction, disclosure or dissemination of
> this message or any attachment by an unintended recipient is strictly
> prohibited.  Neither this message nor any attachment is intended as or
> should be construed as an offer, solicitation or recommendation to buy or
> sell any security or other financial instrument.  Neither the sender, his or
> her employer nor any of their respective affiliates makes any warranties as
> to the completeness or accuracy of any of the information contained herein
> or that this message or any of its attachments is free of viruses.
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> http://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 



More information about the cisco-nsp mailing list