cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
421
Views
0
Helpful
1
Replies

CPU spikes due to edonkey application

I have a 2610 rouer running 12.2.11T code. One ethernet port (e 0/0, x.x.x.x) is connected to a cable modem, which in turn goes to the ISP. One of the users on the network (of interface e 1/1) is using a program called "e-donkey (e-mule). When it runs, the cpu spikes on the router every minutes for 5 seconds, and it puts a CPUHOG- ARP Input (shown below) error in the log. The spike occurs, according to the debug, during a brief period of massive ARP resolutions. Then between spikes, there are debug entries of IP ARP -incomplete entries. The sequence is below. Anyone have experience with this program? And, is there anyway to spread out, or slow down the ARP resolutions? Thanks.

I have replaced the public IP address with x

During the spikes, of which there are hundreds (debug):

Apr 15 21:35:36: IP ARP: sent req src x.x.x.x 0004.c05d.0200,

dst 81.202.169.183 0011.5dc0.1454 Ethernet0/0

Apr 15 21:35:36: IP ARP: sent req src x.x.x.x 0004.c05d.0200,

dst 151.37.64.119 0011.5dc0.1454 Ethernet0/0

Apr 15 21:35:36: IP ARP: sent req src x.x.x.x 0004.c05d.0200,

dst 213.60.36.75 0011.5dc0.1454 Ethernet0/0

Apr 15 21:35:36: IP ARP: sent req src x.x.x.x 0004.c05d.0200,

dst 81.35.134.114 0011.5dc0.1454 Ethernet0/0

Apr 15 21:35:36: IP ARP: sent req src x.x.x.x 0004.c05d.0200,

dst 82.91.39.169 0011.5dc0.1454 Ethernet0/0

Apr 15 21:35:36: IP ARP: sent req src x.x.x.x 0004.c05d.0200,

dst 218.166.203.63 0011.5dc0.1454 Ethernet0/0

Apr 15 21:35:36: IP ARP: sent req src x.x.x.x 0004.c05d.0200,

dst 172.202.220.50 0011.5dc0.1454 Ethernet0/0

Apr 15 21:35:36: IP ARP: sent req src x.x.x.x 0004.c05d.0200,

dst 81.56.134.103 0011.5dc0.1454 Ethernet0/0

Just after the spike (log):

Apr 15 21:35:36: %SYS-3-CPUHOG: Task ran for 2921 msec (50/17), process = ARP Input, PC = 803FB518.

-Traceback= 803FB51C 804777EC 804768B4 8040F64C

Between spikes (debug):

Apr 15 21:35:44: IP ARP: creating incomplete entry for IP address: 80.42.209.57 interface Ethernet0/0

Apr 15 21:35:44: IP ARP: sent req src x.x.x.x 0004.c05d.0200,

dst 81.39.53.102 0000.0000.0000 Ethernet0/0

1 Reply 1

mhussein
Level 4
Level 4

Hi,

The excessive amount of arp queries is probably due to the default route pointing to e0/0 interface. If that is the case, then change the default route statement from:

ip route 0.0.0.0 0.0.0.0 e0/0

to:

ip route 0.0.0.0 0.0.0.0

I am not sure if there is a workaround if the default gateway is dynamic.

HTH,

Mustafa