Hi Guys,
We are clueless already for this troubleshooting. We have FTD acting as an IPS and we are experiencing high CPU for some cores in random basis.
TAC engineer recommends to do flow profiling however, this have an interruption because SNORT process needs to restart and they confirmed it already that it will have an interruption. Is there's other way to get the information included in the flow profiling but without using flow profiling method?
I read also about the the large session traffic ("elephant flow"), my understanding about it is that a single large stream of traffic is cannot handled by FP CPU. But I thought traffic handling of FP load balanced within the CPU cores but why this one large session traffic is an issue? How to check also those traffic which causes this kind of traffic flow?
Hope you can help.
Thanks
