I have a Cisco WS-C4948E switch connected with two ISPs through which I establish a BGP session that announces each IPv4/IPv6 subnet.
The switch is connected to GigabitEthernet1/1 port with a QoS of 150Mbps and represents the connection with ISP1 and TenGigabitEthernet1/50 with a QoS of 2Gbps representing the connection with ISP2.
I have been under a DDoS attack by DNS Amplification for a few days now, targeting all IPs in the advertised subnets. The problem is that my CPU is sitting at 99% even though the cumulative traffic is small and the switch should be processing many more packets without problems.
CPU usage evidence:
show processes cpu sorted
CPU utilization for five seconds: 99%/0%; one minute: 99%; five minutes: 99%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
79 33380786 2451006 13619 61.91% 59.62% 58.90% 0 Cat4k Mgmt LoPri
145 13681631 11384527 1201 25.51% 24.35% 23.81% 0 IP Input
352 6729164 227758 29545 8.15% 11.20% 12.50% 0 OBFL INTR slot-1
78 1214361 4827396 251 1.91% 2.69% 2.68% 0 Cat4k Mgmt HiPri
show processes cpu history
999999999999999999999999999999999999999999999999999999999999
999999999999999999999999999999999999999999999999999999999999
100 **********************************************************
90 **********************************************************
80 **********************************************************
70 **********************************************************
60 **********************************************************
50 **********************************************************
40 **********************************************************
30 **********************************************************
20 **********************************************************
10 **********************************************************
0....5....1....1....2....2....3....3....4....4....5....5....6
0 5 0 5 0 5 0 5 0 5 0
CPU% per second (last 60 seconds)
999999999999999999999999999999999999999999999999999999999999
999999999999999999999999999999999999999999999999999999999999
100 ##########################################################
90 ##########################################################
80 ##########################################################
70 ##########################################################
60 ##########################################################
50 ##########################################################
40 ##########################################################
30 ##########################################################
20 ##########################################################
10 ##########################################################
0....5....1....1....2....2....3....3....4....4....5....5....6
0 5 0 5 0 5 0 5 0 5 0
CPU% per minute (last 60 minutes)
* = maximum CPU% # = average CPU%
999999999999999
999999999999999
100 ###############
90 ###############
80 ###############
70 ###############
60 ###############
50 ###############
40 ###############
30 ###############
20 ###############
10 ###############
0....5....1....1....2....2....3....3....4....4....5....5....6....6....7..
0 5 0 5 0 5 0 5 0 5 0 5 0
CPU% per hour (last 72 hours)
* = maximum CPU% # = average CPU%
Traffic:
cisco01#! Orange ISP
cisco01#show interfaces TenGigabitEthernet1/50 | include rate
Queueing strategy: fifo
5 minute input rate 2930014000 bits/sec, 275290 packets/sec
5 minute output rate 836820000 bits/sec, 69316 packets/sec
cisco01#! RCS&RDS ISP
cisco01#show interfaces GigabitEthernet1/1 | include rate
Queueing strategy: fifo
5 minute input rate 219400000 bits/sec, 54281 packets/sec
5 minute output rate 177663000 bits/sec, 16403 packets/sec
cisco01#! node01
cisco01#show interfaces Port-channel3 | include rate
Queueing strategy: fifo
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
cisco01#! dell1
cisco01#show interfaces Port-channel5 | include rate
Queueing strategy: fifo
5 minute input rate 4380000 bits/sec, 1445 packets/sec
5 minute output rate 477389000 bits/sec, 41260 packets/sec
cisco01#! hp1
cisco01#show interfaces TenGigabitEthernet1/49 | include rate
Queueing strategy: fifo
5 minute input rate 1011133000 bits/sec, 84507 packets/sec
5 minute output rate 220475000 bits/sec, 54166 packets/sec
