I have network that is connected as follows:
9006 router is BGP peering to another 9006 router upstream over a port-channel.
Then the 9006 router locally hands off the Internet connection to an aggregation ios xe 903 router which hosts BDI interfaces for different subnets.
The subnets leave on two different port-channels and are one or the other depending on the upstream l2vpns that are up or down. The upstream l2vpns are not both up at the same time for each port-channel/etherchannel.
The traffic has been pretty much evenly split between the two hand-off port-channels on the aggregation router. Let's call them agg-a and agg-b. They both combined to form a total traffic equal to the total traffic of the uplink to the 9006 equal to 9006-port-channel.
However recently we saw that the port-channels had double the amount of receive traffic on them, nearly 80-90% utilization where the normal usage is about 5%. The normal heavy user is transmit utilization at peak.
We have been able to fix this by turning off the secondary members of teh port-channel.
Any ideas of what this could be? An lacp issue? A denial of service?
