Disclaimer
The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
Liability Disclaimer
In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
Posting
Since your interrupt CPU is within 3% of total CPU %, I would suspect this is due to overall traffic load passing through the router. You didn't post load on your interfaces, but from my experience with this model, CPU will max out as you approach 20 Mbps (duplex).
PS:
Ah, DS3, rate-limited on output. SLA tests. NBAR with text packet inspection and protocol discovery. Route-map, OSPF, longish ACLs, modified command mapping to privledge levels, and more. Not often you see any router with so many features activated, especially a 2811.
If you can graph CPU load with total bandwidth passing through the router, you might find a correlation.
PPS:
I should have previously noted, since everything on the this series of routers is generally processed by the CPU, you can sometimes makes changes to minimize CPU load (leaving more for packet forwarding). For instance: deactivation of unnecessary services (NBAR protocol discovery?); re-ordering, if logically possible, ACLs such that most frequently matched are matched first; combining ACLs, if possible, so fewer comparisons are required; policing, rate-limiting or ACL processing on ingress rather than egress, again if logically possible; using all pertinent caching methods, e.g. flow caching (should help with ACLs) and/or policy caching (for route maps); compiled ACLs (not an intended feature on these platforms, although was available on some early IOS versions); etc.
Doing all the above has the router work as optimally as possible for what's required from it, but you'll still need to match actual hardware performance for offered load.
