[c-nsp] Strange VIP CPU load

[Bill Wichers]

I have customer running some kind of streaming app that seems to be using
excessive CPU load and I'm curious if anyone knows what might cause this.
Normally I only see this kind of VIP load from DoS, not from only about 18
Mb/s more "legit" traffic (total on the interface was about 38-45 Mb/s
during the "problem" period of 100% CPU load.

I would expect an increase in CPU load, but not going from about 30-40% to
100% with only 18Mb/s increase in traffic, one direction (about a 30-40%
increase in total traffic through the interface). Does anyone know what
might cause this much CPU load for normal (i.e., not all minimum-size,
random DoS style packets)? Below is a copy of the per-minute graph from
'show tech' for the VIP. Ingress side VIP only is affected, egress VIP is
not showing anything abnormal, which is unlike DoS. The per-second graph
was pretty much solidly 100% during the peaks that show on the per-minute
graph.

Any ideas or even wild guesses much appreciated!

    -Bill


          |- This is where I shaped the customer at the switch
          |                                            1
     3434449979696699899969497699999999956999966998999906795799
     8496249969297099699936838909989999932799999998999906460599
100        ** * *  ** #** *     ******#*  ****  ** ***#*  *  **
 90        ** * #  #**#** * *  *******#*  ****  ******#*  *  **
 80        *#** #  #**#*# * ** *##*##*#*  ###*  ***#**##  * *#*
 70        *#** #* ##*### * ***###*####*  ###***##*#*###*** *##
 60        *#*#*#**##*###** #**######### *####**########*** *##
 50     *  ##*#############*############*######################
 40  *#*#######################################################
 30  ##########################################################
 20  ##########################################################
 10  ##########################################################
    0....5....1....1....2....2....3....3....4....4....5....5....
              0    5    0    5    0    5    0    5    0    5

               CPU% per minute (last 60 minutes)
              * = maximum CPU%   # = average CPU%



*****************************
Waveform Technology
Systems Engineer