[c-nsp] 6500 - What determines whether certain traffic is punted or not?

[Phil Mayers]

Drew Weaver wrote:
> Howdy,
> 
> I've been having some issues with queue drops/CLI sluggishness on a
> 6500 and I wanted to check what kind of volume of traffic I was
> getting punted to the RP.
> 
> I made a span session and began checking out the traffic with
> tethereal.
> 
> It seems like a huge (30,000) or so packets every few seconds of just
> UDP traffic is being punted.
> 
> The system is a Sup720-3BXL.

What's the IOS version? As posted recently, I've seen FIB/TCAM 
programming errors on some IOSes; try a "shut", "no shut" of the input 
interfaces (if you can)

All kinds of things can cause CPU punts, but primarily you're looking 
for MTU failures, ICMP redirects (packets coming in on an interface 
which is also the outbound interface), glean (next-hop needs ARP) and 
similar.

Obviously if you've somehow managed to fall back to CPU forwarding, but 
that's unlikely from the sounds of it.

Bear in mind that certain kinds of traffic (e.g. RPF failures) are 
"leaked" to the CPU so that it can see & count them; do you have any MLS 
rate-limiters enabled ("sh mls rate-limit")