Cat 3548XL High CPU utilization

abekeris · ‎07-09-2004

We have a network with 27 Cat3548XL switches and a C4006 as a core switch.

Since 2 days ago, the CPU of the C3548XL have been increased to limits more than 80%. We have issued the command "sh proc CPU" and observe that the process "ARP Input" has 23,5% of the CPU.

Also we have issued the command "sh controller switch", but don't know what the results means.

GB24_13#sh controller switch

Switch registers:

Device Type : 0x00010373

Congestion Threshold : 0x00000AD2

Peak Total Allocation : 0x00000015

Total Allocation : 0x00000000

Peak Total Bandwidth : 0x00000164

Total Bandwidth : 0x00000000

Total Bandwidth Limit : 0x00000320

Lower Bandwidth Limit : 0x00000320

Switch Mode : 0x00000000

Cumulative garbage collection collected 0xE buffers.

Also the network performance has been degrade. Can anyone help us ?

rwcrowe · ‎07-09-2004

Are you using any VLAN's or subnets on this network ? What is performing the Layer 3 routing, the Cat 4006 ? Do you have a basic topology drawing ?

abekeris · ‎07-09-2004

we are not using vlan's, all goes to the vlan 1 (default) and the 4006 is just connecting all the switches via gigabit ports.

rwcrowe · ‎07-09-2004

The "ARP Input" process performs all arp requests and responses. This might only apply to routers but you'll probably notice too that the "IP Input" process is high too. Your are see performance problems because your switches and users are all on one flat subnet/vlan. All broadcasts by the PC's and other equipment are seen by the switches and the switch has to process them.

You need to segment your network with VLANS and perform inter-vlan routing. How many users do you have on this network ?

abekeris · ‎07-09-2004

we have about 450 users on this net.

We suppose that there is a station performing a network scan. We are being audited and we suppose that the auditors are doing something.

IP Input is at 0.04%

glen.grant · ‎07-09-2004

This sounds like maybe you have some infected clients that need to be cleaned up , on flat network like this everybody is going to see all the broadcasts and if they are trying to reach addresses that aren't on your network then they will try to ARP first which is what you are seeing .

abekeris · ‎07-09-2004

does anybody knows how do I have to interpret this command ?