CPU Utilization for UDP traffic - IOS IPS

[cunninghamri]

Hi

I am experiencing high CPU utilisation on my 1861 router when the IPS feature is enabled. It would seem that the problem is experienced when UDP traffic is traversing the router. In my lab I am passing 10Mb of traffic through the device using IPERF. When I use TCP streams, my CPU utilisation is around 35%. However, if I pass 10Mb of UDP streams through the router. The CPU constantly sits betwen 98-100%. Is this expected behavior?

I only have the Virus/Worms/Trojan catagory enabled.

Any advice would be appreciated.

Regards

Richard

[sofianecirat]

I would recommend to first start with a packet capture on the interface in question to clarify the situation.

[cunninghamri]

Thanks for your reply. Could you please clarify what you mean? What should I look for in a packet caputure.

To clarify, I have a lab setup and a controlled environment. I am  generating traffic using IPERF.This is the only traffic traversing the router. TCP traffic has a small impact on the CPU but UDP causes the CPU to reach its maximum.

Regards

Richard

[sofianecirat]

I believe there's a bug with iperf using UDP as it spikes the CPU util to %100.

i never used it myself but I know that a lot of people encountered the same issue you're talking about.

I don't know if it was patched, but you can google it to find out.

[Julio Carvajal]

Hello,

Are there any events reported from the IPS while running the test?

Regards

[cunninghamri]

Hi

Thanks for your reply. No, there dont seem to be any events triggerd whilst running the test.

Regards