cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1122
Views
0
Helpful
1
Replies

Problem with 6509E and multicast. High CPU

Hello,

I've got a problem with a core 6509E and the multicast.

A client has a system with cams for the physical security and they are connected to a vlan with this config:

interface VlanX
ip address 172.20.167.1 255.255.255.128
ip helper-address 172.20.32.7
ip pim version 1
ip pim sparse-mode
end

The thing is that we know that one server that shows the cams at the security office is flooding the network and the CPU CORE is over 95% always:

CPU utilization for five seconds: 99%/39%; one minute: 99%; five minutes: 99%

263   644650276 567873287       1135 51.99% 55.06% 55.35%   0 IP Input

Snooping statistics for Vlan17
#channels: 25
#hosts   : 2

Source/Group                    Interface       Reporter        Uptime   Last-Join Last-Leave
0.0.0.0/225.208.160.7           Vl17:Gi4/2      172.20.167.2    1w0d     00:00:15  01:10:36
0.0.0.0/226.208.160.7           Vl17:Gi4/2      172.20.167.2    6d11h    23:38:25  23:38:23
0.0.0.0/227.208.160.7           Vl17:Gi4/2      172.20.167.2    1w0d     00:00:11  01:10:35
0.0.0.0/229.208.160.7           Vl17:Gi4/2      172.20.167.2    1w0d     00:00:13  00:28:08
0.0.0.0/231.208.160.7           Vl17:Gi4/2      172.20.167.2    1w0d     00:00:13  01:10:35
0.0.0.0/232.20.160.7            Vl17:Gi4/2      172.20.167.2    00:01:49 1w0d      1w0d
0.0.0.0/233.20.160.2            Vl17:Gi4/2      172.20.167.2    1w0d     18:07:46  18:07:24
0.0.0.0/233.20.160.3            Vl17:Gi4/2      172.20.167.2    1w0d     00:00:13  01:10:35
0.0.0.0/233.20.160.4            Vl17:Gi4/2      172.20.167.2    1w0d     00:00:09  01:10:35
0.0.0.0/233.20.160.5            Vl17:Gi4/2      172.20.167.2    3d12h    12:56:18  12:55:59
0.0.0.0/233.20.160.7            Vl17:Gi4/2      172.20.167.2    1w0d     00:00:11  00:28:08
0.0.0.0/233.20.160.8            Vl17:Gi4/2      172.20.167.2    1w0d     00:00:15  01:10:35
0.0.0.0/233.20.160.9            Vl17:Gi4/2      172.20.167.2    1w0d     00:00:16  01:45:53
0.0.0.0/233.20.160.10           Vl17:Gi4/2      172.20.167.2    1w0d     00:00:17  01:10:37
0.0.0.0/233.20.160.12           Vl17:Gi4/2      172.20.167.2    1w0d     00:00:11  01:10:37
0.0.0.0/233.20.160.13           Vl17:Gi4/2      172.20.167.2    1w0d     18:07:48  18:07:26
0.0.0.0/233.20.160.14           Vl17:Gi4/2      172.20.167.2    1w0d     00:00:09  01:10:37
0.0.0.0/233.20.160.15           Vl17:Gi4/2      172.20.167.2    1w0d     00:00:14  01:10:38
0.0.0.0/234.20.160.5            Vl17:Gi4/2      172.20.167.2    1w0d     00:00:14  01:10:38
0.0.0.0/234.20.160.7            Vl17:Gi4/2      172.20.167.2    00:00:19 1d00h     1d00h
0.0.0.0/234.20.160.15           Vl17:Gi4/2      172.20.167.2    00:00:10 1w0d      1w0d
0.0.0.0/235.20.160.7            Vl17:Gi4/2      172.20.167.2    1w0d     00:00:16  00:28:12
0.0.0.0/236.208.160.7           Vl17:Gi4/2      172.20.167.2    1w0d     18:07:55  18:07:43
0.0.0.0/238.208.160.7           Vl17:Gi4/2      172.20.167.2    1w0d     00:00:17  00:28:12
0.0.0.0/239.255.255.250         Vl17:Gi4/2      169.254.148.213 2w5d     2w4d          -
0.0.0.0/239.255.255.250         Vl17:Gi4/2      172.20.167.2    2w5d     00:00:11  1w0d

router#show ip igmp snooping subscriber-rate 172.20.167.2
0.0.0.0/239.255.255.25Vl17:Gi4/2      172.20.167.2    14 pps/20 kbps (1 sec)
0.0.0.0/233.20.160.9  Vl17:Gi4/2      172.20.167.2    161 pps/1611 kbps (1 sec)
0.0.0.0/225.208.160.7 Vl17:Gi4/2      172.20.167.2    127 pps/1278 kbps (1 sec)
0.0.0.0/231.208.160.7 Vl17:Gi4/2      172.20.167.2    157 pps/1609 kbps (1 sec)
0.0.0.0/233.20.160.3  Vl17:Gi4/2      172.20.167.2    157 pps/1621 kbps (1 sec)
0.0.0.0/234.20.160.5  Vl17:Gi4/2      172.20.167.2    164 pps/1666 kbps (1 sec)
0.0.0.0/233.20.160.4  Vl17:Gi4/2      172.20.167.2    151 pps/1544 kbps (1 sec)
0.0.0.0/233.20.160.12 Vl17:Gi4/2      172.20.167.2    136 pps/1385 kbps (1 sec)
0.0.0.0/233.20.160.14 Vl17:Gi4/2      172.20.167.2    157 pps/1624 kbps (1 sec)
0.0.0.0/233.20.160.15 Vl17:Gi4/2      172.20.167.2    176 pps/1775 kbps (1 sec)
0.0.0.0/233.20.160.8  Vl17:Gi4/2      172.20.167.2    177 pps/1806 kbps (1 sec)
0.0.0.0/233.20.160.10 Vl17:Gi4/2      172.20.167.2    156 pps/1597 kbps (1 sec)
0.0.0.0/227.208.160.7 Vl17:Gi4/2      172.20.167.2    137 pps/1397 kbps (1 sec)
0.0.0.0/233.20.160.7  Vl17:Gi4/2      172.20.167.2    129 pps/1296 kbps (1 sec)
0.0.0.0/238.208.160.7 Vl17:Gi4/2      172.20.167.2    156 pps/1581 kbps (1 sec)
0.0.0.0/235.20.160.7  Vl17:Gi4/2      172.20.167.2    153 pps/1552 kbps (1 sec)
0.0.0.0/229.208.160.7 Vl17:Gi4/2      172.20.167.2    140 pps/1430 kbps (1 sec)

                                                 --------------------------
                                          Total =   2448 pps/24792 kbps (1 sec)


What can I do to keep normal the CPU ??

Thanks

1 REPLY 1
Dale Miller
Cisco Employee

Can you please tell us what supervisor and code. First thing I would recommend is a CPU span to determine why multicast traffic is punted. Are the multicast applications working or failing. You can try looking at the buffers for the ingress VLAN.

show buffers input-interface VLAN header <--- review the header of the packet in the buffer at that time.

This will give you a quick look and rule out something like TTL.

Other outputs I would want to see

show ip mroute count

show ip mroute

Thanks,

Dale