I have this situation(generic topology):
router1 ---- Cisco7600 ----router2
router 1 communicates with router2 via router Cisco 7600. Normaly all traffic through Cisco 7600 is hardware switched.
This Cisco 7600 has sup720 3BXL (IOS 12.2(33)SRE6) and has MPLS PE functionality.
Recently I noticed huge increase in CPU utilisation due to interrupts. CPU usage is 50% (only interrupt part).
It can be seen that a lot of packets are going to CPU (but also it is only 1% of all traffic going through 7600):
Interface IBC0/0(idb 0x47A73BA8)
Hardware is Mistral IBC (revision 5)
5 minute rx rate 123309000 bits/sec, 32020 packets/sec
5 minute tx rate 124188000 bits/sec, 31856 packets/sec
I sniffed/collected packets going to CPU and didn't noticed any "usualy problematic" ones.
(i.e. with TTL=1, IP options, broadcast or multicast).
further more there is no CEF exception:
show mls cef exception status
Current IPv4 FIB exception state = FALSE
Current IPv6 FIB exception state = FALSE
Current MPLS FIB exception state = FALSE
significant percentage of all collected packets going to CPU are ( in wireshark noted as): ESP, GRE(PPP), SMB (Microsoft), DCE/RPC(Microsoft).
As I can recall ESP (IPSec) or GRE or Netbios should be forwarded in hardware (especially since 7600 just pass through traffic. It is not end point).
Has anybody encountered problem like this?
I'm concerned because I don't think this packets should go to CPU or I am wrong?
(I attached few sniffed representative packets. When I capture/sniff traffic going to CPU for only 1 second, I can found cca 1500 packets of each "attached example")
Thanks in advance,
Has anything changed in the configuration recently that could affect traffic going through ?
There are always restrictions/limitations as to what can be hardware switched and what packets need to be sent to the CPU and often it is to do with the configuration of the actual device and using an option that is only supported in software.
I agree, but on that Cisco 7600 I have many "interface vlans" with configured "vrf" and ip address (and HSRP config since there is second standby router). I don 't have any additional configuration.
Interface vlan 290
Ip vrf forwarding XYZ
Ip address 192.168.200.2
Standby 0 ip 192.168.200.1
And 99% of traffic is hardware switched.
Packets handled at interrupt level caused high CPU. There are multiple reason including a BUG. Please refer the below URL for troubleshooting.
Sathvik K V