Symantec ghost causing high cpu utilization on 6509 switch

[Endwigast]

Hi,

We have a stack of 10 2950-48 switches with 4 vlan configured, that stack is connected via trunk to a 6509 switch. Now everytime we are ghosting pc's on the same vlan our 6509 switch utilization goes up > 75%. What do you guys think is causing this. Thanks.

Odie

[Prashanth Krishnappa]

Have you configured multicast routing on a router or enabled IGMP querier feature on the 6500? Without an IGMP querier, multicast would be broadcast to all ports in the VLAN.

[Endwigast]

We are using a cat6509 switch. How do you enable that? How does multicast cause high cpu utilization? We are only ghosting on 1 of the 4 vlans.

[Endwigast]

Hi,

I already found out what is causing the high cpu utilization. Everytime somebody is ghosting the ghost server sends a lot udp packets destined to this ip 224.77.231.253:7777. What I did was I created an access-list that blocks that "deny udp any any eq 7777". I could see hits on the access-list but still the cpu utilization is high. Any idea how to block that? Thanks.

[lgijssel]

Multicasting definitely IS your issue like others already stated. The best solution would be to deactivate multicasting on your ghost server. This should be done in the application, unfortunately I do not exactly know where. My guess is, it should not be too hard to find it.

An other option would be to make the ghost vlan really small, 10-12 ports at the most.

Regards,

Leo

[Endwigast]

Hi,

The thing is we are only ghosting 2 workstations at a time. Even with only 2 workstations being ghosted the cpu utilization of the switch goes up to >90%. T_T

[lgijssel]

It is the flooding to all ports that drives your cpu up. This has nothing to do with the amount of clients that are using the application.

[Endwigast]

Hi,

I ran a network analyzer while they were ghosting. The ghost server was sending a lot of packets to this ip --> 224.77.231.253:7777. I blocked that using ACL still the cpu utilization is high. How will the flooding to all ports hurt the 6509?

I thought it would only use the gateway (which is the 6509 vlan gateway) when it wants to go to other vlans (routing). If it wants to go to the same vlan the only process would be switching, right? so why does it drive the cpu up?

[Prashanth Krishnappa]

Can you paste the output of sh mod and sh proc cpu?

IGMP snooping is enabled by default. So, configure ip multicast-routing and PIM dense mode under the VLAN interface of the router(MSFC). Or use the querier option available in newer OS

http://www.cisco.com/warp/public/473/38.html#Querier_feature

The following page should help as well

http://www.cisco.com/en/US/partner/tech/tk828/technologies_tech_note09186a0080094821.shtml

[Endwigast]

Hi,

I'll try the querier and post the result here. We can't ghost right now because it's the middle of production. Thank you all for the help and time.

[Endwigast]

Hi,

I applied querier to the vlan where we are ghosting. I think it solved the problem however we are only ghosting 2 workstations at a time - no noticable increase in core switch cpu utilization. I will have to wait until the end of the week so we could ghost the whole floor and paste the results here if it really solved the problem. Thanks.

[Endwigast]

I think it did the trick. Thanks for all the help