insight manager causes router problems due to high ARP INPUT rate

[Erik Molenaar]

Probably more of a router issue.....

We have seen serious router problems due to the use of Insight Manager. Its discovery process, scanning a wide range of ip's, causes the ARP INPUT counter in SHOW PROC CPU to rise high, slowing down the router. The following could be seen at times of trouble:

Aug 21 18:14:04: %DUAL-5-NBRCHANGE: IP-EIGRP 20: Neighbor 10.100.151.250 (Vlan784) is down: holding time expired

Aug 21 18:14:05: %DUAL-5-NBRCHANGE: IP-EIGRP 20: Neighbor 10.110.254.253 (Vlan790) is down: holding time expired

Aug 21 18:14:20: %DUAL-5-NBRCHANGE: IP-EIGRP 20: Neighbor 10.100.145.253 (Vlan785) is down: holding time expired

Aug 21 18:14:58: %DUAL-5-NBRCHANGE: IP-EIGRP 20: Neighbor 10.110.254.253 (Vlan790) is up: new adjacency

Aug 21 18:15:10: %DUAL-5-NBRCHANGE: IP-EIGRP 20: Neighbor 10.110.254.250 (Vlan790) is down: peer restarted

Aug 21 18:15:10: %DUAL-5-NBRCHANGE: IP-EIGRP 20: Neighbor 10.110.254.250 (Vlan790) is up: new adjacency

Aug 21 18:15:18: %DUAL-5-NBRCHANGE: IP-EIGRP 20: Neighbor 10.110.254.253 (Vlan790) is down: holding time expired

Also Citrix network connections where broken.

Apart form upgrading to another IOS level that supports Policing and ARP throttling, does anyone know if it is possible to slow down Insight Manager a bit in it's discovery enthousiasm?

Thanks,

Erik

[mchin345]

Guess this is a bug with Insight Manager. Did you check out the known bugs in the bug tool kit for this?

[Erik Molenaar]

Hi,

We blocked all traffic to/from that station, and the local manager found out that the machine was infected with blaster.... That explains it all. It was cleaned, and looking brite and shiny right now!

Thanks for your reply!

Erik