High CPU (IP INPUT) Cat6509 Native IOS 12.2

Unanswered Question
Mar 14th, 2007

Hello Pro's

I have this issue:

High cpu utilization (IP INPUT).

GiFi event manager is on 192.168.120.6 collects events from PCs (e.g. 192.168.114.81). At the time GiFi collects it's data, CPU utilization level is about 70%.

Take a look at the time stamps in log(see below), TCP ACK numbers (they are the same!!!).

Packets routed via FIB. Does it mean they go through CPU (IP INPUT)?

How to decrease CPU load?

Here's debug ip pack det log:

==============================================

Mar 14 13:59:50.377: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), g=192.168.120.6, len 576, forward

Mar 14 13:59:50.377: TCP src=445, dst=4150, seq=2279847765, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.377: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), len 576, sending full packet

Mar 14 13:59:50.377: TCP src=445, dst=4150, seq=2279847765, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.377: IP: tableid=0, s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), routed via FIB

Mar 14 13:59:50.377: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), g=192.168.120.6, len 576, forward

Mar 14 13:59:50.377: TCP src=445, dst=4150, seq=2279848301, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.377: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), len 576, sending full packet

Mar 14 13:59:50.377: TCP src=445, dst=4150, seq=2279848301, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.377: IP: tableid=0, s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), routed via FIB

Mar 14 13:59:50.377: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), g=192.168.120.6, len 576, forward

Mar 14 13:59:50.377: TCP src=445, dst=4150, seq=2279848837, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.377: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), len 576, sending full packet

Mar 14 13:59:50.377: TCP src=445, dst=4150, seq=2279848837, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.377: IP: tableid=0, s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), routed via FIB

Mar 14 13:59:50.377: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), g=192.168.120.6, len 576, forward

Mar 14 13:59:50.377: TCP src=445, dst=4150, seq=2279849373, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.377: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), len 576, sending full packet

Mar 14 13:59:50.381: TCP src=445, dst=4150, seq=2279849373, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.381: IP: tableid=0, s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), routed via FIB

Mar 14 13:59:50.381: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), g=192.168.120.6, len 576, forward

Mar 14 13:59:50.381: TCP src=445, dst=4150, seq=2279849909, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.381: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), len 576, sending full packet

Mar 14 13:59:50.381: TCP src=445, dst=4150, seq=2279849909, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.381: IP: tableid=0, s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), routed via FIB

Mar 14 13:59:50.381: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), g=192.168.120.6, len 576, forward

Mar 14 13:59:50.381: TCP src=445, dst=4150, seq=2279850445, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.381: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), len 576, sending full packet

Mar 14 13:59:50.381: TCP src=445, dst=4150, seq=2279850445, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.381: IP: tableid=0, s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), routed via FIB

Mar 14 13:59:50.381: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), g=192.168.120.6, len 576, forward

Mar 14 13:59:50.381: TCP src=445, dst=4150, seq=2279850981, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.381: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), len 576, sending full packet

Mar 14 13:59:50.381: TCP src=445, dst=4150, seq=2279850981, ack=2010463565, win=17124 ACK

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 3 (1 ratings)
Loading.
deniska2006 Wed, 03/14/2007 - 20:35

Hello amit singh

Thanks a lot, but I have already read all articles corresponding Higth CPU load due to IP INPUT. And reading these articles I found out that the issue is in IP INPUT process and I posted what I found.

I believe the problem is in host 192.168.120.6

But I don't understand why I see these packets (same src and dest port) in log, doesn't it mean they were RP switched? CEF is ON on all interfaces. Shouldn't only one (first) packet be RP switched and the rest packets related to the same flow fast switched?

What about log? Does it look good? 80% of 5 sec log filled with the same messages during debugging.

If I am right then how to solve the prob, if not just let me know, I'll read all those articles again carefully :-)

Actions

This Discussion