Buy or Renew
Buy or Renew
Cisco + Splunk: It’s a new day for your data. Learn more.
 
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
1972
Views
3
Helpful
2
Replies

High CPU (IP INPUT) Cat6509 Native IOS 12.2

deniska2006
Level 1
Level 1

‎03-14-2007 04:06 AM - last edited on ‎03-25-2019 03:54 PM by Community Manager

Hello Pro's

I have this issue:

High cpu utilization (IP INPUT).

GiFi event manager is on 192.168.120.6 collects events from PCs (e.g. 192.168.114.81). At the time GiFi collects it's data, CPU utilization level is about 70%.

Take a look at the time stamps in log(see below), TCP ACK numbers (they are the same!!!).

Packets routed via FIB. Does it mean they go through CPU (IP INPUT)?

How to decrease CPU load?

Here's debug ip pack det log:

==============================================

Mar 14 13:59:50.377: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), g=192.168.120.6, len 576, forward

Mar 14 13:59:50.377: TCP src=445, dst=4150, seq=2279847765, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.377: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), len 576, sending full packet

Mar 14 13:59:50.377: TCP src=445, dst=4150, seq=2279847765, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.377: IP: tableid=0, s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), routed via FIB

Mar 14 13:59:50.377: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), g=192.168.120.6, len 576, forward

Mar 14 13:59:50.377: TCP src=445, dst=4150, seq=2279848301, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.377: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), len 576, sending full packet

Mar 14 13:59:50.377: TCP src=445, dst=4150, seq=2279848301, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.377: IP: tableid=0, s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), routed via FIB

Mar 14 13:59:50.377: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), g=192.168.120.6, len 576, forward

Mar 14 13:59:50.377: TCP src=445, dst=4150, seq=2279848837, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.377: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), len 576, sending full packet

Mar 14 13:59:50.377: TCP src=445, dst=4150, seq=2279848837, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.377: IP: tableid=0, s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), routed via FIB

Mar 14 13:59:50.377: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), g=192.168.120.6, len 576, forward

Mar 14 13:59:50.377: TCP src=445, dst=4150, seq=2279849373, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.377: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), len 576, sending full packet

Mar 14 13:59:50.381: TCP src=445, dst=4150, seq=2279849373, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.381: IP: tableid=0, s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), routed via FIB

Mar 14 13:59:50.381: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), g=192.168.120.6, len 576, forward

Mar 14 13:59:50.381: TCP src=445, dst=4150, seq=2279849909, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.381: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), len 576, sending full packet

Mar 14 13:59:50.381: TCP src=445, dst=4150, seq=2279849909, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.381: IP: tableid=0, s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), routed via FIB

Mar 14 13:59:50.381: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), g=192.168.120.6, len 576, forward

Mar 14 13:59:50.381: TCP src=445, dst=4150, seq=2279850445, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.381: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), len 576, sending full packet

Mar 14 13:59:50.381: TCP src=445, dst=4150, seq=2279850445, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.381: IP: tableid=0, s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), routed via FIB

Mar 14 13:59:50.381: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), g=192.168.120.6, len 576, forward

Mar 14 13:59:50.381: TCP src=445, dst=4150, seq=2279850981, ack=2010463565, win=17124 ACK

Mar 14 13:59:50.381: IP: s=192.168.114.81 (Vlan4), d=192.168.120.6 (Vlan6), len 576, sending full packet

Mar 14 13:59:50.381: TCP src=445, dst=4150, seq=2279850981, ack=2010463565, win=17124 ACK

Labels:
0 Helpful
2 Replies 2

Amit Singh
Cisco Employee
Cisco Employee

‎03-14-2007 06:15 AM

Hello,

Please use the linke below of troubleshooting the high CPU on cat6500.

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a00804916e0.shtml#ios

http://www.cisco.com/warp/customer/63/highcpu_ip_input.html

HTH,Please rate if it does.

-amit singh

deniska2006
Level 1
Level 1
In response to Amit Singh

‎03-14-2007 08:35 PM

Hello amit singh

Thanks a lot, but I have already read all articles corresponding Higth CPU load due to IP INPUT. And reading these articles I found out that the issue is in IP INPUT process and I posted what I found.

I believe the problem is in host 192.168.120.6

But I don't understand why I see these packets (same src and dest port) in log, doesn't it mean they were RP switched? CEF is ON on all interfaces. Shouldn't only one (first) packet be RP switched and the rest packets related to the same flow fast switched?

What about log? Does it look good? 80% of 5 sec log filled with the same messages during debugging.

If I am right then how to solve the prob, if not just let me know, I'll read all those articles again carefully :-)

0 Helpful
Customers Also Viewed These Support Documents
Review Cisco Networking products for a $25 gift card