High CPU Utilization in Cisco 1760 Router

[md_ani]

Hi,

I am having a Router connected to Internet with Public IPs. Since last week I am receiving Alerts from my HPOV Server regarding High CPU Utilization in Cisco 1760 Router. Pls help what could be the reason. IOS is 12.3. While troubleshooting, Show Process CPU is showing that 'IP Input' is taking max. CPU

[Giuseppe Larosa]

Hello,

you need to verify if there a lot of packets that are process switched instead of being switched by CEF of fast switching.

Process switched packets require more CPU resources.

Try with the sh ip cef and look for the counters of packets not processed by CEF

May be your router is under attack and is receiving packets that have ip options in header that are process switched because you have public ip addresses on it

Hope to help

Giuseppe

[md_ani]

Pls find below the output of "Show IP Cef" from which i am not able to understand anything.

Prefix Next Hop Interface

0.0.0.0/0 attached Serial1/0

0.0.0.0/32 receive

69.165.235.104/30 attached Serial1/0

69.165.235.104/32 receive

69.165.235.106/32 receive

69.165.235.107/32 receive

69.165.235.144/28 attached FastEthernet0/0

69.165.235.144/32 receive

69.165.235.145/32 receive

69.165.235.146/32 69.165.235.146 FastEthernet0/0

69.165.235.147/32 69.165.235.147 FastEthernet0/0

69.165.235.148/32 69.165.235.148 FastEthernet0/0

69.165.235.150/32 69.165.235.146 FastEthernet0/0

69.165.235.156/32 69.165.235.146 FastEthernet0/0

69.165.235.169/32 receive

172.17.0.0/16 69.165.235.146 FastEthernet0/0

172.18.0.0/16 69.165.235.146 FastEthernet0/0

224.0.0.0/4 drop

224.0.0.0/24 receive

255.255.255.255/32 receive

Pls help.

[a.alekseev]

show the configuration

[md_ani]

Pls find config as attachment.

[a.alekseev]

try to enable CEF

interface FastEthernet0/0

ip route-cache cef

ip route-cache

!

interface Serial1/0

ip route-cache cef

ip route-cache

and show the output

sh int f0/0

sh int s1/0

[md_ani]

Cef enable as suggested. Pls find attach the Sh Int Output.

[a.alekseev]

could you show the output

"sh proc cpu sort 5min" or

"sh proc cpu | e 0\.00"

[md_ani]

Pls find below the output

**********************************

sh proc cpu | exclude 0.0

CPU utilization for five seconds: 12%/8%; one minute: 12%; five minutes: 8%

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

42 653733451 757247646 863 2.12% 1.53% 1.11% 0 IP Input

108 1839 3142 585 1.14% 0.50% 0.32% 6 Virtual Exec

**********************************

Hope by enabling IP CEF Cache, we are not opening any Security Hole.

[a.alekseev · Accepted solution]

The CPU load looks normal.

You are not opening any Security Hole by enabling IP CEF Cache.

[gajanangavli]

May i know in which case we should run the CEF

[paolo bevilacqua]

In any case, and it's the default.

[md_ani]

Thanx Dear. Till now I have not received alert. Hope the problem is resolved now.