Hi CPU Utilization on 6509 MSFC2 with Supervisoe 1

[cbeswick]

Hi All,

The switch is running in hybrid mode any routes many Vlans.

Over the last week the MAX CPU utilisation has gone through the roof. Max utilisation hits about 90%, with an average of around 70% over a 9-5 working day period.

Is it excessive IP traffic that has caused the sudden increase in utilization? I have made a few changes to some of the Layer 3 interfaces to make the network more secure, like disabling ip proxy-arp, but nothing else has changed on the switch.

Is there any way I can find out which subnet or device / application is causing this? I have attached an "show proc cpu".

[glen.grant]

Look at your interfaces , most likely you will find one that has high utilization specially any layer3 SVI's that are configured . This usually means your traffic is being processed switched instead of hardware switched . Look for 1 interface that has high a number of drops and misses when you do a show interface command . If you find an interface that also has packets in the input queue you can dump those packets and this will tell who is doing the traffic . You can do the "show buffers input-interface vlan XX dump " command to see who is doing the damage to the cpu. The input queue is the line you are concerned with, if there is anything in that first column dump the queue and it will tell you the address of the person who is filling the queue . Usually you will also see a lot of drops and misses too .

Vlan99 is up, line protocol is up

Hardware is EtherSVI, address is 0011.5df3.b800 (bia 0011.5df3.b800)

Internet address is 192.168.99.254/24

MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation ARPA, loopback not set

ARP type: ARPA, ARP Timeout 04:00:00

Last input 00:00:04, output 00:00:09, output hang never

Last clearing of "show interface" counters 15:40:26

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0