[j-nsp] M20 stops processing icmp/snmp/local traffic

[Gary Tate]

This looks like it could be some kind of DOS attack on the RE or the RE 
is being over utilized.  The traffic types you are talking about are 
mostly handled by the RE, including the TCP termination of the bgp 
peers.

Take a look at:
show pfe statistics traffic
show system statistics <protocol>
show system queues
show chassis routing-engine

Have a look for high levels of traffic/drops and high utilization on 
the RE CPU as well as the PFE CPU.

I would advise you to contact the JTAC so they can help you investigate 
this problem further,
Gary

On Nov 17, 2003, at 8:39 PM, billp wrote:

> M20, running 5.6R2.4.  Has been up for 143 days, no issues.
>
> Suddenly, it stops processing some traffic:
> 	- snmp queries to the router time out
> 	- icmp to the router times out
> 	- icmp through the router times out sometimes
> 	- ssh to router times out
> 	- router cannot ping some local devices connected to it
> 	- 4 of 25 BGP sessions dropped and will not re-establish
>
> Strange thing is, other traffic seems to be passing through
> it fine.  We can reach devices through the router, and we
> are passing 700+ Mb/s traffic through the various interfaces.
>
> show pfe * all looks good, no obvious problems
>
> sho chassis ssb shows the ssb processor at 70% (about 20% higher
> than normal.)  Our 40-50% CPU is usually caused by sampling, so
> I disabled all sampling.  No change.
>
> top doesn't show any processes running crazy or hogging cpu,
> load average on RE is 0.20ish.
>
> Any other thoughts on what to look for or try?
>
> thanks
> bill
>
>
> _______________________________________________
> juniper-nsp mailing list juniper-nsp at puck.nether.net
> http://puck.nether.net/mailman/listinfo/juniper-nsp
>