topic Re:High CPU due to packet capture in Network Security

High CPU due to packet capture

Krishna Chandrashekar — Tue, 12 Mar 2019 02:28:47 GMT

Hi,

IF we do not remove packet capture on ASA does it cause CPU to spike?

Regards,

Krishna

High CPU due to packet capture

Krishna Chandrashekar — Thu, 22 Aug 2013 14:50:56 GMT

Hi,

Still awaiting ur reply

High CPU due to packet capture

secureIT — Thu, 22 Aug 2013 19:42:08 GMT

whether a single src to single dst pcap or network ?

ideally not recommended to keep the pcap enabled, but still less impact on asa.

instead of you deciding pcap as a source of high cpu, it would be better to check whether its a cosmetic bug or genuine bug.

regards

Rajesh

High CPU due to packet capture

Krishna Chandrashekar — Fri, 23 Aug 2013 06:03:25 GMT

Hi,

There were 4 packet caps running on the device all were SRC to DEST.

How much CPU does each packet cap can take.

Regards,

Krishna

High CPU due to packet capture

secureIT — Sat, 24 Aug 2013 02:59:54 GMT

Pls ask if you have some other queries. Only development team can answer to ur qsn.

High CPU due to packet capture

Krishna Chandrashekar — Sat, 24 Aug 2013 05:04:45 GMT

Cpu was alright when captures were removed so just wanted to make sure it was due to that

Re:High CPU due to packet capture

Vibhor Amrodia — Sat, 24 Aug 2013 12:07:26 GMT

Did we have circular buffer captures enabled ? Which asa device are you seeing this issue on ?

Re:High CPU due to packet capture

Krishna Chandrashekar — Sun, 25 Aug 2013 03:00:34 GMT

No. Circualr buffer was nt enabled, my question is once the buffer is full, will that lead to high CPU or not. The ASA is 5540

Re:High CPU due to packet capture

Vibhor Amrodia — Sun, 25 Aug 2013 15:33:17 GMT

Hi Krishna,

We have seen this problem before on some TAC cases and we do have a Bug Defect for the same issue.

Although this Bug Defect is not resolved as we were not able to recreate the issue.

Re:High CPU due to packet capture

Krishna Chandrashekar — Mon, 26 Aug 2013 04:12:59 GMT

Hi,

Thanks very much replying, so ideally it should be dropping the packets once the buffer is full.

Regards,

Krishna

Re:High CPU due to packet capture

Krishna Chandrashekar — Mon, 26 Aug 2013 07:11:13 GMT

Here is the packet cap that was on the firewall.

capture cap1 type        raw-data interface PATSv2 [Buffer Full - 523510 bytes]
match ip any        host 87.236.65.84
capture cap2 type raw-data interface PATSv2 [Buffer        Full - 523510 bytes]
match ip host 87.236.65.84 any
capture CAP1        type raw-data interface market_server_dmz [Capturing - 1476 bytes]
match        ip host 172.16.96.12 host 172.21.62.104
capture CAP2 type raw-data        interface inside [Capturing - 1170 bytes]
match ip host 172.16.96.12        host 172.21.62.104

So is it confirmed that CPU got spiked by bug defect. ?

Regards,

Krishna

Re:High CPU due to packet capture

Krishna Chandrashekar — Tue, 27 Aug 2013 05:52:05 GMT

Still awaiting ur reply

Re:High CPU due to packet capture

Vibhor Amrodia — Tue, 27 Aug 2013 13:45:53 GMT

Hi Krishna,

Can you post the CPU status increase with the captures apllied on the ASA so that we can verify the increase.

If the capture Buffer is full , the captures would not have any impact on the ASA device and the respective interface and no further traffic would be captured.

The Bug Defect is not resolved and we were not able to recreate the issue in lab.

If you are able to recreate the issue in Lab , i would request you to open a TAC case and we might try to resolve the Bug Defect.

Thanks and Regards,

Vibhor Amrodia

Re: High CPU due to packet capture

hkaraeen — Mon, 26 Feb 2024 14:36:39 GMT

could you please provide me with bug id

Re: High CPU due to packet capture

tvotna — Mon, 26 Feb 2024 14:52:38 GMT

E.g. CSCta43472