cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1260
Views
0
Helpful
21
Replies

6509 High CPU

niro
Level 1
Level 1

I'm having a problem with one of our 6509s, the CPU on it constantly goes up to close to 100% for a minute and then drops back down to single digits (it happens every few minutes), it's not causing connectivity issues yet, but I'm worried that it eventually will. I can't really figure out what's going on, I'm pretty sure it's multicast traffic causing the problem though. I've attached a very basic diagram of our network.

Most of the multicast traffic would originate either from Core1 or Core2, although some multicast originates from either of the distribution switches or the access switches. All the interfaces and vlans are set up with sparse-dense mode and we're not using any RP's right now.

The switch that's having the cpu spikes is distribution 1...we're running EIGRP for routing.

Can anybody help me figure what's going on? Here is the output of show proc cpu when the cpu jumps up.

CPU utilization for five seconds: 95%/79%; one minute: 24%; five minutes: 27%

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

86 3728919922187837326 0 14.58% 3.07% 4.77% 0 IP Input

170 109925716 998945240 110 0.57% 0.22% 0.23% 0 Port manager per

Thanks for any help!

21 Replies 21

b.julin
Level 3
Level 3

The only time I've seen our 65xx with high IP-Input cpu was due to NAT, sometimes packet scans can saturate your tables, and the hold time on NAT translations is too high for some setups.

So if you have NAT on a segment of untrusted PCs that may scan around, try

ip nat translation tcp-timeout 1800

No it's not NAT...it's definitely the multicast traffic in sparse mode hitting the CPU.

We're not doing any natting on the 6509...we have an FWSM which does natting but I'm not having any problems with it.

I've taken a look at this and I'm beginning to wonder if this isn't non-rpf traffic on the L2 links.

Check this out:

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a00804916e0.shtml#Non-RPF

Any way you could sniff the l2 port between dist1/2 to see if off tree traffic is reaching the "redundant" multicast router? Check to see if a (s,g) or (*,G) entry exists - if not, you may have just found the culprit.

HTH

Geoff

I didn't sniff the traffic on the l2 port but I did run sh ip mroute sparse on the core 2 router (the multicast server in this case is located on core 1)...here is what I get:

(*, 231.1.1.77), 00:01:44/00:02:10, RP 10.20.20.1, flags: SP

Incoming interface: Null, RPF nbr 0.0.0.0

Outgoing interface list: Null

Also core 1 is the active vlan and core 2 has the standby vlan.

any other ideas of why this would be happening?

Hi All,

I am facing a strange issue. Could be devaiting from the mulicast and all that stuff. My Sup 720's CPU utilisation is normally 30%, but when i run a show run / write memory command, the CPU spikes to >90% and then drops. Is this a normal behaviour?

Is there any document from Cisco, which says it could be normal.

I have put down the dir NVRAM: o/p here

=============================

Directory of nvram:/

1918 -rw- 397431 startup-config

1919 ---- 24 private-config

1920 -rw- 397431 underlying-config

1 ---- 48 persistent-data

2 ---- 4 rf_cold_starts

3 -rw- 0 ifIndex-table

1964024 bytes total (1563445 bytes free)

=============================

Regards,

Karthikeyan

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: