DHCP storm isssue in 3750 stack switches

[rakesh.sandhu82]

Please let me know if anyone is familiar with this issue and help me to fix this.

switch#sh processes cpu sort | e 0.00
CPU utilization for five seconds: 94%/6%; one minute: 92%; five minutes: 89%
 PID Runtime(ms)     Invoked      uSecs   5Sec   1Min   5Min TTY Process
 285     4913147    10514143        467 64.33% 61.31% 59.08%   0 DHCPD Receive
 220    16941161    46086550        367 15.20% 14.51% 13.64%   0 IP Input
 218      352631      131808       2675  1.12%  0.82%  0.79%   0 IP ARP Adjacency
  12    20286991    31265792        648  0.95%  0.79%  0.80%   0 ARP Input

Let me know if you need further information on it.

Thanks,

Rakesh Sandhu

[christopher jardine]

Hello,

could it be a client device flooding DHCP requests?

do you have access to wireshark?

if not i saw on a post to setup an ACL for DHCP with log turned on and see if all of them are coming from the same MAC address.

[rakesh.sandhu82]

This got fixed. One IP phone was connected in two diff VLAN and LAN was learning one mac on two different ports causing DHCP storm. Disconnecting one cable on phone fixed this issue. Thanks all for your help.

[Rajeev Sharma]

Hey Rakesh,

Depending upon the platform use we may monitor the traffic directed to CPU, if it's:

3750:

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/troubleshooting/cpu_util.html#wp1023843

4500:

http://www.cisco.com/c/en/us/support/docs/switches/catalyst-4000-series-switches/65591-cat4500-high-cpu.html#tool2

You may check which host is sending the DHCP packets to CPU and isolate it from network.

HTH.

Regards,

RS.