Catalyst 3650 high cpu utilization

[KirillKO]

Hello, Cisco Community!

We've encountered high CPU utilization issue on our 2x3650 stack.

Processes eating CPU are: ARP Input, SISF Switcher Th, SISF Main Thread
Issue is happening only on working hours, so likely that connected to user activity.

We tried disabling ip dhcp snooping on user VLANs and adding deny all rule for ipv6 but nothing helps.

Switch firmware is 16.6.6, haven't seen any related bugs for this version.

Do you have any ideas what else to check?

Thanks a lot!

[KirillKO]

Not really. Apple watch can connect to the same Wireless network as connected iPhone. So we've found several occasions of ARP flooding by several apple watch devices already, however it takes time to search for its owner and check more details on flooding device.

[KirillKO · Accepted solution]

As a conclusion, we've found the root cause description here https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvw92906/?rfs=iqvred

Packet captures showed us that CPU utilization is getting high when the ARP flood was happening and luckily we were able to identify Apple Watch devices having this behaviour from time to time while connected to the office Wi-Fi.

Hopefully, after we decided to upgrade WLC software to the latest 8.10.151.0 version the issue hasn't been encountered again(it's almost 3 weeks after the upgrade).

Thanks to all the community members who helped us here!

[paul driver]

Hello
As you mention disabling dhcp snooping i am assuming this is a layer2 host stack with ip routing disabled with just a single svi for mgt purposes and is that svi enabled for fast switching?

Do you have any active:

span or tap sessions 

igmp snooping 

port-security 

arp inspection  

Check if you have a full stack ring

Any multiple spanning- tree transisions

your access- ports have port-fast enabled 

any interface errors