[c-nsp] Cisco 7204VXR with NPE-G1 high CPU and output drops

Youssef Bengelloun-Zahr youssef at 720.fr
Fri Apr 23 05:13:19 EDT 2010


Hello Olga,

Does this command could BGP to flap or something like that ?

Y.



2010/4/23 Olga <olved at list.ru>

> check if you are using "ip accounting output-packets" on your interfaces.
> If there are a lot of of small packets ,accounting table gets overflowed,
> and you will get high cpu. We had this problem year ago, it took several
> days to find out the reason :) And today we had it again on one router, but
> it took just couple of seconds to figure out that one of our client was hit
> by DDos and, ironicaly, he had this command on interface.
>
> During attack:
>
> CPU utilization for five seconds: 82%/76%; one minute: 86%; five minutes:
> 90%
>
> After we removed ip accounting output-packets from interface:
>
> CPU utilization for five seconds: 59%/56%; one minute: 59%; five minutes:
> 63%
>
>
> Cool, huh?
>
>
> check out output of
>
> sh ip accounting output-packets
>
>
>
> > For information, the problem moved from one router to another identical
> > one and I can see the exact same symptoms. Gotta find the guilty bastard
> ;-)
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



-- 
Youssef BENGELLOUN-ZAHR ………………………………………………
Ingénieur Réseaux et Télécoms


Technopole de l'Aube  en Champagne - BP 601 - 10901 TROYES  Cedex 9
Agence Paris : 6, rue Charles Floquet - 92120 MONTROUGE
Tel                 +33 (0) 825 000 720
Tel. direct      +33 (0) 1 77 35 59 14
Tel. portable  +33 (0) 6 22 42 63 80
Email            ybz at 720.fr
……………………………………………………………………………….....www.720.fr


More information about the cisco-nsp mailing list