CISCO IPS 4260 CPU USAGE 99%

[Luis Carranza]

Hi guys

I'm detecting something unusual on my CISCO IPS 4260. This device have 2 CPU's but only in one cpu is showing 99% of use, and the inspection load varies from 40 to 50, and sometimes 80, here's a screenshot of what I'm talking about.

Where can I start to troubleshoot why is showing this values.?

Regards.

[Julio Carvajal]

Hello Luis,

We often see cases like these,

I would encourage you from now on troubleshooting or monitoring the inspection load on the IPS's to determine how they are doing as cpu utilization may not reflect real sensor load

Here is one bug ID you could follow for more information:

CSCtl74475

Let us know how the inspection load of the IPS is? and remember to rate all of the helpful posts

Regards

[Luis Carranza]

Hi

Thanks for your answer, I will monitoring the inspection load to see if the the behavior, in fact it maintain between 40 and 50 but sometimes goes up to 80 but this is only for a few seconds.

Another thing, do you think is normal that the IPS signature with more hits is de SIGID 5575 (NBT NetBIOS Session Service Failed Login?

Regards.

[Julio Carvajal]

do you think is normal that the IPS signature with more hits is de SIGID 5575 (NBT NetBIOS Session Service Failed Login?

After doing some research it seems to be normal for a windows enviroment.

Here is the information I got

Description

When a client connects to a SMB server (WinNT, Win95, Samba, etc..) a TCP connection to port 139 is established. The client then provides the server with its NetBIOS name and the NetBIOS name it wishes to connect to. If the name does not exist on the server, the session setup attempt fails and an error message is sent to the client. This could be an indicator of an attack.

Recommended Filter

Exclude internal networks as sources.

Benign Triggers

The default alarm level for this is low because this happens during normal network activity within a Windows network. As an example, when mounting the C: drive from a Windows 95 system to a Windows NT system, numerous session setup failures can occur while browsing the file system.

As you can see you could excluded to stop triggering that, this is an informational signature

Regards,

Remember to rate all of the helpful posts