[c-nsp] High CPU caused by interupt on 7600 router

[Phil Mayers]

On 01/10/10 16:24, Rin wrote:
> Hi Phil,
> Thanks for your email. Below is my answer:
>
>> Do you have any CoPP or MLS limiters enabled? I am thinking particularly
> the TTL and MTU ones.

> The CPU only spikes in less than a minute show I cannot catch it when it
> high. I had CoPP applied as below

Since the system logs, you could use an EEM applet to trigger a "sh proc 
cpu" and direct output to a file?

>
> The output shows more than 12Mbps of traffic (matched by class-default) is
> sending to CPU. I believe this is value is high but I could not determine
> what type of traffic is sending to CPU

In which case I would SPAN the CPU.

>> You could ERSPAN the RP/SP CPU to a remote machine, then correlate CPU
> spikes with the captured traffic.

> How can I do this? Do you have any guideline?

conf t
mon sess 1 type erspan-source
source cpu rp
source cpu sp
destination
ip address <your monitoring box>
# various other options
exit
no shut

...then on your monitoring box, run "gulp | tcpdump" or "wireshark"