[c-nsp] Arp Input Process Causing Spike in CPU

[Phil Mayers]

Gert Doering wrote:
> Hi,
> 
> On Thu, Mar 15, 2007 at 09:44:23AM -0400, Christian Koch wrote:
>> I'm seeing cpu spikes due to  the arp input process running high ..
>>
>> Currently every route is pointed to next hop and the arp table looks
>> like..
>>
>> #sh ip arp sum
>> 1743 IP ARP entries, with 21 of them incomplete
> 
> 1743 ARP entries?
> 
> Over *thousand seven hundred* entries?  What sort of networks have you
> connected to this router...?

me-core#sh ip arp sum
2528 IP ARP entries, with 35 of them incomplete

ac-core#sh ip arp sum
5175 IP ARP entries, with 55 of them incomplete

saf-core#sh ip arp sum
2117 IP ARP entries, with 10 of them incomplete

...and this on a weekend. I'm fairly sure we see 30% more during the week.

It's not an unreasonable figure in some deployments. The OP did not 
initially state his hardware or topology type of course, but not 
everyone has just 120 /30s and full BGP tables on their routers ;o)

Though the OP has now found the problem, for the archives I'll state 
that I've seen ARP Input CPU spikes on 6500s for a number of reasons; 
misbehaving clients being the most common one, and "sh ip cef ev | inc 
ADJ" or "RP SPAN" are very useful for tracing these.