[j-nsp] SCB Utilization Threshold?

[Jeff Wheeler]

On Tue, 2004-03-23 at 17:14, Erik Haagsman wrote:
> I've seen strange things happen to SCB/SFM levels while there was no
> actual reason apart from capturing/exporting flows (which I thought had
> nothing to do with the SCB/SFM).
> 
> Or could it haven been firewall filters scanning for certain IP option
> fields that yanked the SCB/SFM up high (over 60%)...?

Sampling is another task that uses the exception processor.  I believe
only packets which will actually be sampled are handled by it.  If you
are sampling at a high rate, you would have high SCB CPU utilization.

All conditions that can be examined by the firewall filters should be
handled by the IP II.  The meer persence of the terms looking for the IP
option packets wouldn't cause high CPU utilization, however the option
packets being transited through your box (as opposed to being discarded)
would contribute to high SCB/SFM CPU utilization.

-- 
Jeff at Reflected Networks