01-22-2021 02:29 AM
Hello, Cisco Community!
We've encountered high CPU utilization issue on our 2x3650 stack.
Processes eating CPU are: ARP Input, SISF Switcher Th, SISF Main Thread
Issue is happening only on working hours, so likely that connected to user activity.
We tried disabling ip dhcp snooping on user VLANs and adding deny all rule for ipv6 but nothing helps.
Switch firmware is 16.6.6, haven't seen any related bugs for this version.
Do you have any ideas what else to check?
Thanks a lot!
Solved! Go to Solution.
03-09-2021 05:17 AM
Not really. Apple watch can connect to the same Wireless network as connected iPhone. So we've found several occasions of ARP flooding by several apple watch devices already, however it takes time to search for its owner and check more details on flooding device.
05-18-2021 04:46 AM
As a conclusion, we've found the root cause description here https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvw92906/?rfs=iqvred
Packet captures showed us that CPU utilization is getting high when the ARP flood was happening and luckily we were able to identify Apple Watch devices having this behaviour from time to time while connected to the office Wi-Fi.
Hopefully, after we decided to upgrade WLC software to the latest 8.10.151.0 version the issue hasn't been encountered again(it's almost 3 weeks after the upgrade).
Thanks to all the community members who helped us here!
02-12-2021 09:18 AM
Hello
As you mention disabling dhcp snooping i am assuming this is a layer2 host stack with ip routing disabled with just a single svi for mgt purposes and is that svi enabled for fast switching?
Do you have any active:
span or tap sessions
igmp snooping
port-security
arp inspection
Check if you have a full stack ring
Any multiple spanning- tree transisions
your access- ports have port-fast enabled
any interface errors
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide