04-22-2005 04:11 PM - edited 03-03-2019 09:22 AM
I have a 2610 rouer running 12.2.11T code. One ethernet port (e 0/0, x.x.x.x) is connected to a cable modem, which in turn goes to the ISP. One of the users on the network (of interface e 1/1) is using a program called "e-donkey (e-mule). When it runs, the cpu spikes on the router every minutes for 5 seconds, and it puts a CPUHOG- ARP Input (shown below) error in the log. The spike occurs, according to the debug, during a brief period of massive ARP resolutions. Then between spikes, there are debug entries of IP ARP -incomplete entries. The sequence is below. Anyone have experience with this program? And, is there anyway to spread out, or slow down the ARP resolutions? Thanks.
I have replaced the public IP address with x
During the spikes, of which there are hundreds (debug):
Apr 15 21:35:36: IP ARP: sent req src x.x.x.x 0004.c05d.0200,
dst 81.202.169.183 0011.5dc0.1454 Ethernet0/0
Apr 15 21:35:36: IP ARP: sent req src x.x.x.x 0004.c05d.0200,
dst 151.37.64.119 0011.5dc0.1454 Ethernet0/0
Apr 15 21:35:36: IP ARP: sent req src x.x.x.x 0004.c05d.0200,
dst 213.60.36.75 0011.5dc0.1454 Ethernet0/0
Apr 15 21:35:36: IP ARP: sent req src x.x.x.x 0004.c05d.0200,
dst 81.35.134.114 0011.5dc0.1454 Ethernet0/0
Apr 15 21:35:36: IP ARP: sent req src x.x.x.x 0004.c05d.0200,
dst 82.91.39.169 0011.5dc0.1454 Ethernet0/0
Apr 15 21:35:36: IP ARP: sent req src x.x.x.x 0004.c05d.0200,
dst 218.166.203.63 0011.5dc0.1454 Ethernet0/0
Apr 15 21:35:36: IP ARP: sent req src x.x.x.x 0004.c05d.0200,
dst 172.202.220.50 0011.5dc0.1454 Ethernet0/0
Apr 15 21:35:36: IP ARP: sent req src x.x.x.x 0004.c05d.0200,
dst 81.56.134.103 0011.5dc0.1454 Ethernet0/0
Just after the spike (log):
Apr 15 21:35:36: %SYS-3-CPUHOG: Task ran for 2921 msec (50/17), process = ARP Input, PC = 803FB518.
-Traceback= 803FB51C 804777EC 804768B4 8040F64C
Between spikes (debug):
Apr 15 21:35:44: IP ARP: creating incomplete entry for IP address: 80.42.209.57 interface Ethernet0/0
Apr 15 21:35:44: IP ARP: sent req src x.x.x.x 0004.c05d.0200,
dst 81.39.53.102 0000.0000.0000 Ethernet0/0
04-22-2005 05:27 PM
Hi,
The excessive amount of arp queries is probably due to the default route pointing to e0/0 interface. If that is the case, then change the default route statement from:
ip route 0.0.0.0 0.0.0.0 e0/0
to:
ip route 0.0.0.0 0.0.0.0
I am not sure if there is a workaround if the default gateway is dynamic.
HTH,
Mustafa
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide