High CPU utilization due to IP Input

[oscar.garcia88]

Hi!

I have a Cisco 7600 and recently experimented high CPU utilization.

Thanks in advance.

[Georg Pauwen]

Hello,

can you post the running config (sh run) of the 7609 ? In the meantime, check the troubleshooting info linked below:

https://www.cisco.com/c/en/us/support/docs/routers/7500-series-routers/41160-highcpu-ip-input.html

[oscar.garcia88]

Thanks a lot, I'll check it out

[MHM Cisco World]

220 1973557112 3640113288 0 5.27% 5.40% 5.42% 0 IP Input <<- 
this meaning the traffic is switching use SW not HW, 
point to check 
1- are you have any issue with MTU 
2- are you config GW for client and did you disable proxy arp 

[oscar.garcia88]

Thanks for your comments,

1. As far as I know we do not have issues with MTU, ¿is there a way to tshoot this?

2. We did not config GW for client.

Do you need another info?

Thanks in advance.

[MHM Cisco World]

""As far as I know we do not have issues with MTU, ¿is there a way to tshoot this?""
I make double check you config GRE tunnel but you dont config MTU under tunnel, config MTU under tunnel 

 ""We did not config GW for client""
so the Client send arp ask IP each time it need to connect to outside it subnet, 
OK check show arp 
see if there is large number of incomplete ARP 

[oscar.garcia88]

Ok, let me check the show arp. On the other hand we shut down bgp session and CPU utilization decreased a little bit. We are facing intermittences of LDP on the interface gi1/26, we disable LDP temporarily but CPU utiization reamins the same. 

Thanks in advance.

[MHM Cisco World]

let me check my note 

[oscar.garcia88]

do you have any comment?

[oscar.garcia88]

.

[MHM Cisco World]

just to mention that I dont forget you issue I analysis it, Hope tonight get something. 
for command you ask there is debug BUT with this high CPU using debug can kill your router so I will analysis data you share and figure out the issue and how can we solve it. 

[oscar.garcia88]

Thanks a lot for your comments.

I'll be pending

[MHM Cisco World]

I spent two nights figure out Why there is ARP for IP's include range of same subnet, 
I found that 
1- you under ping sweep miscellaneous
2- your admin run ARP-Scan to detect conflict IP 

Internet 207.248.224.194 225 001a.3029.9500 ARPA Vlan2
Internet 207.248.224.195 0 Incomplete ARPA
Internet 207.248.224.196 0 Incomplete ARPA
Internet 207.248.224.197 0 Incomplete ARPA
Internet 207.248.224.198 0 Incomplete ARPA
Internet 207.248.224.199 0 Incomplete ARPA
Internet 207.248.224.201 0 Incomplete ARPA
Internet 207.248.224.202 0 Incomplete ARPA
Internet 207.248.224.203 0 Incomplete ARPA
Internet 207.248.224.204 0 Incomplete ARPA
Internet 207.248.224.205 0 Incomplete ARPA
Internet 207.248.224.206 0 Incomplete ARPA

but compare to IP Input the main issue is IP Input not ARP Input.
220 1973557112 3640113288 0 5.27% 5.40% 5.42% 0 IP Input
12 644210716 793653526 811 0.71% 0.68% 0.65% 0 ARP Input

[MHM Cisco World]

Now the issue will divide 
MTU Issue 
I see the config and see GRE multipoint tunnel meaning not P2P but multi tunnel with not set MTU this can make CPU fragment each packet sent via tunnel 

the command to check this is issue of CPU utilize 
1- do show ip traffic 
check the fragment counter 

2- repeat command multi times check the fragment counter is increase rapidly or not 

if yes then you need to reduce the MTU, just to remember the MTU of GRE header is 24 bytes. 

share the show ip traffic counter here

[oscar.garcia88]

Thanks for the comments. I'm gonna check the fragment counter