[nsp] 7200 "ARP Input" CPU utilization

[Jay Stewart]

Thanks Cameron, a default static route pointed at one of the
FastEthernet interfaces (rather than the next hop IP) appears to have
been the culprit.

As to the other suggestions offered by all;

"ip cef" caused memory segmentation and almost completely crashed the
router. (of course, this was before I removed the static route that was
causing the CPU problems.)

Process-Switching problem;  Like I said, there was only 1mbps or so of
routed traffic on this box, and the CPU was minimal (even with much
larger traffic flows) before a default route IP change yesterday.

We have Proxy ARP turned off, but there seems to be a great deal of ARP
traffic coming from one of our upstreams (connected by FastEthernet) so
I think they might be misconfigured.  I'll have to check into this one
further.

Also, there was no evidence of a DOS attack.  We scrub our systems
regularly, and have had only one instance of the latest crop of worms
infecting a customer and we wield the clue bat with great joy.  

Thanks again for all the suggestions, especially the one that seems to
have fixed my problem.

Jay Stewart

-----Original Message-----
From: Cameron Dry [mailto:cdry at connect.com.au] 
Sent: Wednesday, September 10, 2003 8:56 PM
To: jacob at stewarts.us
Subject: RE: [nsp] 7200 "ARP Input" CPU utilization


Oh - also high cpu used by the arp process is also
related to having static routes pointing to an
interface instead of a next-hop - so it is good
practice to always use the next-hop ip in your
static routes rather than the interface (where
possible).

Regs

----------------------------------
Cameron Dry
CCIE #10705

Senior Presales Engineer
Connect Internet Solutions Pty Ltd
180-188 Burnley Street
Richmond  VIC  3121

Ph: +61 3 8414 3108
Fx: +61 3 8414 3115
mailto: cdry at connect.com.au





-----Original Message-----
From: Jay Stewart [mailto:jacob at stewarts.us]
Sent: Thursday, 11 September 2003 13:18
To: cisco-nsp at puck.nether.net
Subject: [nsp] 7200 "ARP Input" CPU utilization


Hello,

I'm having some trouble with a 7206 that has been running pretty
flawlessly for almost a year now, no recent major config or network
changes.  Historic CPU utilization was running between 1% - 4%, but now
is bouncing between 15% and 60%, peaking at 80%, with performance
fluctuating between "OK" to "chunky".  The router in question is *NOT*
pushing much traffic, about 1.5m to 3.0m in/out through the FastEthernet
interfaces (f0/0 and f2/0) and an ATM DS3 on a PA-T3-A3+ and should not
be experiencing the performance slowdowns I'm seeing.

I've sifted http://www.cisco.com/warp/public/63/queue_drops.html#before
through my clue sponge (brain) but nothing suggested there seems to
help.

Looking at the process list suggests ARP seems to be the culprit.

CPU utilization for five seconds: 48%/3%; one minute: 48%; five minutes:
49%
  16    13493288   4354803       3098 12.53% 26.44% 25.75%   0 ARP Input
  35          32      1625         19  0.00%  0.00%  0.00%   0 ATM OAM
Input
  42     6133028  10307755        594 15.64% 15.16% 17.19%   0 IP Input

Hopefully, someone can suggest some troubleshooting steps or tips, or
maybe someone has had a similar problem that they resolved successfully
and can offer some advice.  No suggestion to simple at this point.
Thanks in advance to anyone who can help me figure this out.

Jay Stewart

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

The information contained in this email message and any attachments may
be ficticious and may also be the subject of legal bobitty bob.  If you
are not the intended recipient of this email, you will be cursed by a
Transylvanian Gypsy.  Achievement of Transcendental Joy from reading
this material is unauthorised and prohibited.  Please burn this message.