[c-nsp] unicast IPv4 packets punted on Cisco 4500

[Andras Toth]

Hi Martin,

"Event: SA Miss" means that the MAC Source Address needs to be learnt (or
re-learnt) so the switch send a copy of the packet to CPU for learning the
MAC address. Perhaps the MAC is not learn yet, or the aging timer is too
low, or the MAC is learnt on another port already and it's flapping.

Best regards,
Andras


On Mon, Oct 20, 2014 at 4:26 PM, Martin T <m4rtntns at gmail.com> wrote:

> Hi,
>
> I have a following topology:
>
> "Ethernet tester" <-> [Gi6/45]WS-C4506[Gi6/48] <->
> [Gi0/15]ME-3600X-24FS-M[Gi0/23] <-> HW-loop
>
>
> "Ethernet tester" sends out test packets(IPv4 header on top of DIX
> frame), but for some reason those packets are punted in WS-C4506:
>
> Index 0:
> 12 days 7:16:15:714130 - RxVlan: 900, RxPort: Gi6/45
> Priority: Medium, Tag: No Tag, Event: SA Miss, Flags: 0x40, Size: 512
> Eth: Src 00:00:00:00:00:11 Dst 00:18:63:00:32:76 Type/Len 0x0800
> Ip: ver:IpVersion4 len:20 tos:0 totLen:494 id:0 fragOffset:0 ttl:255
> proto:254
>     src: 192.168.1.1 dst: 192.168.1.2 firstFragment lastFragment
> Remaining data:
>  0: 0x79 0x6B 0xEB 0x5D 0x47 0xDA 0x89 0xB0 0x0  0x2
> 10: 0x0  0x1  0x37 0x62 0x0  0x0  0xAA 0xAA 0xAA 0xAA
> 20: 0xAA 0xAA 0xAA 0xAA 0xAA 0xAA 0xAA 0xAA 0xAA 0xAA
>
>
> This obviously causes very high CPU utilization and dropped packets
> according to "sh platform cpu packet statistics". As seen in "show
> platform cpu packet buffered"  output above, it's unicast IPv4
> traffic. Any ideas why such packets hit the CPU?
>
>
> thanks,
> Martin
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>