[nsp] 7200 "ARP Input" CPU utilization

[Brian R. Watters]

Sho ip cac | 0000 0800

This if you have cache flow turned on will show lots of fun I am sure ..


Brian R. Watters
Senior Director
http://www.americanbroadbandservice.com
brwatters at abs-internet.com
866-827-4638 ext. 0205
559-420-0205 direct
559-272-5266 fax
 
 

This message and any attachment(s) are solely for the use of intended
recipients. They may contain privileged and/or confidential information
legally protected from disclosure. If you are not the intended recipient,
you are hereby notified that you received this e-mail in error and that any
review, dissemination, distribution or copying of this e-mail and any
attachment(s) is strictly prohibited. If you have received this e-mail in
error, please contact the sender and delete the message and any
attachment(s) from your system. Thank you for your cooperation.



-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Brian Wallingford
Sent: Wednesday, September 10, 2003 9:07 PM
To: Michael Loftis
Cc: cisco-nsp at puck.nether.net

Enable flow switching if you haven't already, and use "sh ip cache flow | in
[regex]" to narrow down the culprits.  Your ARP storms are most likely due
to a rash of unreachables related to worm traffic.

Then, filter as necessary (to preserve your own network integrity) & break
out the cluebat.

On Wed, 10 Sep 2003, Michael Loftis wrote:

:Get your neighbors to clean the worms off their boxen?  Seems like that is
:the culprit, lots and lots of excess ARP traffic....You doing proxy arp? 
:or one of your ethernet neighbors doing proxy arp?  Causing it spew ARP
:packets for hosts it shouldn't?
:
:Actually acidentally ran into this configuration less than a week ago on my
:Linux based firewall.  Gave a 7206VXR a bit of a hangover until I figured
:out my mistake.
:
:--On Wednesday, September 10, 2003 8:18 PM -0700 Jay Stewart
:<jacob at stewarts.us> wrote:
:
:> Hello,
:>
:> I'm having some trouble with a 7206 that has been running pretty :>
flawlessly for almost a year now, no recent major config or network :>
changes.  Historic CPU utilization was running between 1% - 4%, but now :>
is bouncing between 15% and 60%, peaking at 80%, with performance :>
fluctuating between "OK" to "chunky".  The router in question is *NOT* :>
pushing much traffic, about 1.5m to 3.0m in/out through the FastEthernet :>
interfaces (f0/0 and f2/0) and an ATM DS3 on a PA-T3-A3+ and should not :>
be experiencing the performance slowdowns I'm seeing.
:>
:> I've sifted http://www.cisco.com/warp/public/63/queue_drops.html#before
:> through my clue sponge (brain) but nothing suggested there seems to :>
help.
:>
:> Looking at the process list suggests ARP seems to be the culprit.

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
---
[Scanned for viruses & SPAM with safE-Mail by American Broadband Services]
---