[nsp] 7200 "ARP Input" CPU utilization

[Michael Loftis]

Get your neighbors to clean the worms off their boxen?  Seems like that is 
the culprit, lots and lots of excess ARP traffic....You doing proxy arp? 
or one of your ethernet neighbors doing proxy arp?  Causing it spew ARP 
packets for hosts it shouldn't?

Actually acidentally ran into this configuration less than a week ago on my 
Linux based firewall.  Gave a 7206VXR a bit of a hangover until I figured 
out my mistake.

--On Wednesday, September 10, 2003 8:18 PM -0700 Jay Stewart 
<jacob at stewarts.us> wrote:

> Hello,
>
> I'm having some trouble with a 7206 that has been running pretty
> flawlessly for almost a year now, no recent major config or network
> changes.  Historic CPU utilization was running between 1% - 4%, but now
> is bouncing between 15% and 60%, peaking at 80%, with performance
> fluctuating between "OK" to "chunky".  The router in question is *NOT*
> pushing much traffic, about 1.5m to 3.0m in/out through the FastEthernet
> interfaces (f0/0 and f2/0) and an ATM DS3 on a PA-T3-A3+ and should not
> be experiencing the performance slowdowns I'm seeing.
>
> I've sifted http://www.cisco.com/warp/public/63/queue_drops.html#before
> through my clue sponge (brain) but nothing suggested there seems to
> help.
>
> Looking at the process list suggests ARP seems to be the culprit.
>
> CPU utilization for five seconds: 48%/3%; one minute: 48%; five minutes:
> 49%
>   16    13493288   4354803       3098 12.53% 26.44% 25.75%   0 ARP Input
>   35          32      1625         19  0.00%  0.00%  0.00%   0 ATM OAM
> Input
>   42     6133028  10307755        594 15.64% 15.16% 17.19%   0 IP Input
>
> Hopefully, someone can suggest some troubleshooting steps or tips, or
> maybe someone has had a similar problem that they resolved successfully
> and can offer some advice.  No suggestion to simple at this point.
> Thanks in advance to anyone who can help me figure this out.
>
> Jay Stewart
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/



--
Undocumented Features quote of the moment...
"It's not the one bullet with your name on it that you
have to worry about; it's the twenty thousand-odd rounds
labeled `occupant.'"
   --Murphy's Laws of Combat