[nsp] Catalyst6509 GE interface hang without any indication

[Mohacsi Janos]

On Fri, 4 Jun 2004, Joe Shen wrote:

> Thanks you all. Thanks for your kindly help.
>
> In past days, I'm trying to identify the exact source of problem.
>
> There has been three possible reasons:
>
> 1. Software bug with CatOS
> 2. Security problem with IOS12.1
> 3. Overloading of MSFC/PFC for netflow data collecting
>
> In order to make clear what's the exact reason, we set up a little
> testbed with a Catalyst6509 with the same CatOS & IOS version
> of the system which experienced problem.
>
> I've download a little C program which is announced to be used as
> remaking TCP security problem with IOS, and I tried with
> one of GE interface IP address, but it seems the GE interface kept on
> working. ( I'm not sure whether the program do covers all possible
> hacking problem.)
>
> We have also read all those page, you have kindly pointed out. And, find
> the software version is listed in the list.
>
> But,  I'm still not clear whether netflow data collecting could derive
> to system hang if the Catalyst6509's overall load is heavy?
> ( I used full mode of netflow data collecting )
>
>
> Has anyone or Cisco did experiments with sideeffect of netflow
> collecting on Catalyst6509 behavior?

On Catalyst 6509 netflow data collection done in HW. The aging of netflow
entries and exporting them done by central CPU. I remember a figure for
MSFC2:

50000 flow/s full flow: aging 20 % CPU, exporting 50% CPU

If you have to handle more flow then enable sampling.

Regards,

Janos Mohacsi
Network Engineer, Research Associate
NIIF/HUNGARNET, HUNGARY
Key 00F9AF98: 8645 1312 D249 471B DBAE  21A2 9F52 0D1F 00F9 AF98