Dispatch Unit - High CPU

[edward ventura]

Hi All,

I'm trying to do some research on the Dispatch Unit process.  It seems High CPU and this process go hand in hand.  I haven't figured out an effective way of determining what underlying issue is the actual source.  Can someone point me in the right direction to try an understand what the Dispatch Unit process is doing?  I have an ASA 5550.  I have seen the cpu hover around 85% +- 5% for sustained long periods, 30 - 60 min +.  I have always been under the impression that around 80% cpu and you're probably dropping packets (that could be an out-dated belief).

Any help to understand this is much appreciated.

-E

[Julio Carvajal]

Excellent Information Olushile

As I said before, when dealing with this kind of issues (Dispatch-Unit) use:

1. Captures
2. Show conn

   3-  Show local-host | include host|count/limit

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

[Joe Silver]

I've also ran into this issue recently in my network.  I do receive alerts for high CPU via snmp polling but is there a way to receive an alert of some kind for hosts that I would consider have a high number of UDP or TCP connections? Example: a single host uses over 200 connections on the firewall.  This number of connections may indicate malware or possibly some kind of peer to peer activity going on in the host.

Having such an alert would allow me to troubleshoot a high CPU issue that much quicker.

Thanks,

Joe

[Raul Ricano]

I was having this issue with only 4 connections at a remote site on an ASA 5505.  It initially look like ISP packet loss, but after troubleshooting for a While I ran across this same High CPU.. After using the following to troubleshoot I still did not see the problem on the firewall.

show xlate count

show conn

show conn count

show block

show memory detail

show processes cpu-usage

show processes cpu-hog

show processes memory

show interface

show traffic

show mroute

show local-host

**Turned out the issue was caused by someone creating a loop on the local switch behind the ASA's internal interface.. After I walked the local tech from identifying/removing this loop the CPU issue disappeared**

Unplugged one cable at a time to figure out what was causing the high CPU and find the loop.

hope this helps others.