I have a 2801 which on which I see sudden rise in CPU util for approx 1 minute constantly close to 80%, by the time my monitoring tool tells me this and I login to check the reason its back to normal. So I enabled an EEM script to check what process is using the CPU and the result says it it the IP INPUT process. I checked the interface utils during the time of the CPU rise and there is a rise in util of one of the interfaces that connects to the access switch that coincides with the CPU rise. This means that there is some traffic coming form the access side (possible from a connected server) which the CPU cannot handle in interrupt and has to invoke the IP INPUT process. The next job for me is to identify what traffic is it. Anyone could help me on how to do it ??
