nexus 7000 ping high latency

[DavidChen886]

The n7k works as the core switch of my company network,but when I ping the ip of n7k,it some times have high latency.

When we ping the ip of internet,it works without the high latency.

I've already disabled the copp of n7k.

What can I do with it ?

PING 172.24.1.254 (172.24.1.254) 56(84) bytes of data.
64 bytes from 172.24.1.254: icmp_seq=1 ttl=255 time=0.658 ms
64 bytes from 172.24.1.254: icmp_seq=2 ttl=255 time=252 ms
64 bytes from 172.24.1.254: icmp_seq=3 ttl=255 time=0.603 ms
64 bytes from 172.24.1.254: icmp_seq=4 ttl=255 time=251 ms
64 bytes from 172.24.1.254: icmp_seq=5 ttl=255 time=0.503 ms
64 bytes from 172.24.1.254: icmp_seq=6 ttl=255 time=259 ms
64 bytes from 172.24.1.254: icmp_seq=7 ttl=255 time=0.706 ms
64 bytes from 172.24.1.254: icmp_seq=8 ttl=255 time=283 ms
64 bytes from 172.24.1.254: icmp_seq=9 ttl=255 time=0.702 ms

[Sergiu.Daniluk]

Hi @DavidChen886 

First things first: you NEVER disable COPP. You can change it to a different profile (strict, moderate, lenient, dense) or you can create and modify policies, but you do not disable it. This will leave your CPU unprotected.

Why is important to NOT disable CoPP? It is because all Nexus platforms are doing all transit routing and switching in hardware/ASIC. Meaning CPU is only left for Control Plane work. Because of this, the CPU is not very "powerful" and any broadcast storm or any intended or unintended high volume of traffic being sent to CPU can bring down your entire network.

Now, when you ping Nexus 7000, the traffic is redirected to CPU. Since ping is not marked as "important" traffic - like for example STP or any other control plane protocol, it will not be prioritized by the CPU. In other words, using this test (pinging the Nexus) for "testing" the latency in the network is not a valid test. If you do not see any latency for traffic passing through the switch, then it's fine.

Recommendation: enable the CoPP back. If you see latency or drops while pinging the CPU it might be expected, depending on the traffic being sent to CPU at that moment. You can always check what traffic is received by CPU using ethanalyzer tool. Here is a link how to use ethanalyzer: https://www.cisco.com/c/en/us/support/docs/switches/nexus-7000-series-switches/116136-trouble-ethanalyzer-nexus7000-00.html

Stay safe,

Sergiu

[balaji.bandi]

how is your COPP config ?