[c-nsp] Arp Input Process Causing Spike in CPU

[Rodney Dunn]

>From 2500 to 5k?

How much time was between those captures?

I always recommend folks do "term exec prompt time" when
getting outputs from Cisco boxes.

If you have that many arp entries it's pretty likely you may
see some input queue drops if you don't bump the input queue depth
up.

And check the arp socket queue in 'sh ip traffic':

ARP statistics:
  Rcvd: 0 requests, 33 replies, 0 reverse, 0 other
  Sent: 24 requests, 12 replies (0 proxy), 0 reverse
  Drop due to input queue full: 0


Rodney

On Sun, Mar 18, 2007 at 10:19:56AM +0000, Phil Mayers wrote:
> Gert Doering wrote:
> > Hi,
> > 
> > On Thu, Mar 15, 2007 at 09:44:23AM -0400, Christian Koch wrote:
> >> I'm seeing cpu spikes due to  the arp input process running high ..
> >>
> >> Currently every route is pointed to next hop and the arp table looks
> >> like..
> >>
> >> #sh ip arp sum
> >> 1743 IP ARP entries, with 21 of them incomplete
> > 
> > 1743 ARP entries?
> > 
> > Over *thousand seven hundred* entries?  What sort of networks have you
> > connected to this router...?
> 
> me-core#sh ip arp sum
> 2528 IP ARP entries, with 35 of them incomplete
> 
> ac-core#sh ip arp sum
> 5175 IP ARP entries, with 55 of them incomplete
> 
> saf-core#sh ip arp sum
> 2117 IP ARP entries, with 10 of them incomplete
> 
> ...and this on a weekend. I'm fairly sure we see 30% more during the week.
> 
> It's not an unreasonable figure in some deployments. The OP did not 
> initially state his hardware or topology type of course, but not 
> everyone has just 120 /30s and full BGP tables on their routers ;o)
> 
> Though the OP has now found the problem, for the archives I'll state 
> that I've seen ARP Input CPU spikes on 6500s for a number of reasons; 
> misbehaving clients being the most common one, and "sh ip cef ev | inc 
> ADJ" or "RP SPAN" are very useful for tracing these.
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/