Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

6500 mls statistics entry

We have some strange problems on Catalyst6500

our cpu utilization up to more 80% and we show mls statistics entry ip below

1.first 6500 -> our stat-pkts and stat-bytes is zero ???

Destination IP Source IP Prot DstPrt SrcPrt Stat-Pkts Stat-Bytes

--------------- --------------- ---- ------ ------ ---------- ---------------

MSFC 10.10.20.251 (Module 15):

10.2.1.14 10.26.51.171 TCP WWW 1376 0 0

10.30.60.166 10.2.1.10 UDP 137 137 0 0

10.2.1.14 10.26.51.171 TCP WWW 1393 0 0

10.10.2.2 10.30.211.228 UDP DNS 1309 0 0

61.62.86.61 10.10.51.139 UDP 4246 1174 0 0

218.175.195.249 10.10.51.139 TCP 4662 2469 0 0

10.30.212.144 10.10.2.2 UDP 3035 DNS 0 0

10.10.101.1 10.30.52.1 TCP Telnet 2895 0 0

10.10.2.8 10.30.8.117 UDP 138 138 0 0

212.68.229.15 10.10.51.201 TCP FTP 1055 0 0

10.10.11.184 10.30.11.81 ICMP 0 0 0 0

10.30.209.42 10.10.2.8 TCP 3113 WWW 0 0

10.30.209.42 10.10.2.8 TCP 3114 WWW 0 0

10.10.2.8 10.30.209.168 UDP 137 137 0 0

61.216.108.242 10.10.51.139 TCP 4662 2187 0 0

10.10.51.139 24.80.227.145 TCP 2381 4662 0 0

10.10.2.8 10.30.205.144 UDP 138 138 0 0

10.10.2.5 10.30.11.71 TCP 2047 1521 0 0

10.10.20.253 10.10.101.6 ICMP 0 0 0 0

10.10.51.139 218.163.33.89 TCP 2103 4662 0 0

2.secondary 6500 -> src to dst port is 137 to 137 ???

Destination IP Source IP Prot DstPrt SrcPrt Stat-Pkts Stat-Bytes

---------------- --------------- ----- ------ ------ ---------- ---------------

10.48.8.170 10.48.11.3 UDP 137 137 1 90

10.48.8.73 10.48.11.3 UDP 137 137 1 90

10.48.8.98 10.48.11.3 UDP 137 137 2 156

10.48.8.52 10.48.11.3 UDP 137 137 4 360

10.48.1.205 10.48.11.3 UDP 137 137 1 84

10.48.11.3 10.48.8.71 UDP 137 137 1 78

10.48.11.3 10.48.2.80 UDP 137 137 2 156

10.10.2.8 10.48.159.128 UDP 137 137 5 390

10.48.11.3 10.48.8.63 UDP 137 137 1 78

10.48.11.3 10.48.8.90 UDP 137 137 1 78

10.48.50.60 10.48.11.2 UDP 137 DNS 2 232

10.48.48.218 10.48.11.2 UDP 137 DNS 2 226

10.48.11.3 10.48.8.170 UDP 137 137 1 78

10.48.11.3 10.48.8.125 UDP 137 137 1 78

10.48.11.3 10.48.2.73 UDP 137 137 1 78

2 REPLIES
Silver

Re: 6500 mls statistics entry

The host 10.48.11.3 looks like it is up to no good , port 137 is netbios traffic . You may be getting hit with a virus .

Cisco Employee

Re: 6500 mls statistics entry

Looks like you are affected by blaster virus

http://www.cisco.com/warp/public/707/cisco-sn-20030814-blaster.shtml

89
Views
0
Helpful
2
Replies
CreatePlease to create content