High traffic levels on RSM

[DanielBowen]

I have an RSM that is experiencing very high traffic levels sporadically. Over last night, two of our VLAN interfaces recieved 450 and 3000 dropped packets respectively. I have used a packets sniffer on the two LANs, but can see no unduely high traffic. Is there any way (on the router) that I can monitor the traffic being input into either of these two VLAN interfaces? When all of this traffic arrives, the sh processes cpu command returns a CPU utilization of 99% and an IP Input of 25%.

any ideas would be very helpful

Thanks.Daniel,

 

[wybnormal]

There are a few questions to be answered. If you get traffic that drives up the cpu, then it's more then likley something like an SAP or ARP storm where every packet has to be processed.. a poorly designed network using something like EIGRP can also do this where the router links are not stable and so the network goes through a massive recalculation every so often(real world.. worked on it.. ugly) You would see a massive spike in CPU utilization but not so much in traffic.

A few things to check.. watch the the
SHOW CPU PROC
and see what process (mine was IPX EIGRP)is sucking up the cycles over a day. Use the snifer to get a 24 hour baseline by monitoring on a switch port that is config'ed to monitor one of the VLANs.. you are not so much trying to catch the traffic yet as you want a graph of utilization. Look at the times and see if backups or any other process kicks off about the same time. A package like Solarwinds will let you grab stats off the ports directly for traffic and catch CPU utilization over the same 24 hours. The demo is good for 30 days but I push to buy it.. it's a very useful tool and easy to use.

MikeS
Find me at

http://www.packetattack.com

"The trouble with giving up civil rights is that you never get them back"

 

[DanielBowen]

Thanks for your input - I have already downloaded this SolarWinds and it is good. With regards to "what is casuing the hike in CPU utilization, it is the IP Input process - when the problem occurs it rises to 20%. Do you know of any "router based" tools that can be implemented that could maybe help in identifiying the culprit station?

Thanks again,

Daniel,

 

[jgercken]

I had this problem...turned out to be a malfunctioning nic spewing broadcasts as fast as it could. Use 5000/6000 command set port broadcast <%> (I use 25) to limit any storm.

You may also have *gulp* a routing loop.

Jeff

 

[DanielBowen]

If I did have a routing loop, how would I go about finding out the exact routes involved?

Thanks for your help