UDP DNS OVERLOAD issue

[c1szhibin]

When I found the internet access is unstable, I checked the gateway router and found the following information all over my screen.

%DNSSERVER-3-UDPDNSOVERLOAD: Low available memory: dropping <id# 31101> from <cli 202.112.51.217>.li 202.112.51.21

And the cpu usage of this router is 99%. After I disconnect the external link, it went back to 0-5%.

Anyone met this before?

[vivek srivastava]

Pls check:

• "sh ip protocols"
• any of the PC in network having some kind of virus which egenerates heavy UDP DNS quaries

[romainsab84]

Hi every body,

I have same problem on my C897VA device and in checking my computer, i found that is my torrent downloading software who genere this problem.

I just need to lauch program for have this problem every 30min while 5min, don't need to downloading for it.

It block every new webpage request...

[paul driver]

Hello

Cas you post the configuration of your router please.

[romainsab84]

Hi Paul,

My config:

version 15.4
service timestamps debug datetime msec
service timestamps log datetime localtime
no service password-encryption
service unsupported-transceiver
!
hostname Cisco-RSA
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 $1$1NEX$5GCPZXEY71reFiG96amd7.
enable password xxxxx
!
aaa new-model
!
!
aaa authentication password-prompt Pass:
aaa authentication username-prompt User:
!
!
aaa session-id common
aaa password restriction
memory-size iomem 20
clock timezone gmt 2 0
!
!
ip dhcp excluded-address 10.1.0.1 10.1.0.20
ip dhcp excluded-address 10.1.254.200 10.1.254.254
ip dhcp excluded-address 10.3.0.1 10.3.0.20
ip dhcp excluded-address 10.3.254.200 10.3.254.254
!
ip dhcp pool default
network 10.1.0.0 255.255.0.0
default-router 10.1.0.1
dns-server 10.1.0.1
lease 0 4
!
ip dhcp pool default.public
network 10.3.0.0 255.255.0.0
default-router 10.3.0.1
dns-server 10.3.0.1
lease 0 2
!
!
!
ip name-server 195.186.1.162
ip name-server 8.8.8.8
ip multicast-routing
ip ddns update method nas-rsa
HTTP
add http://xxxxx@dynupdate.no-ip.com/nic/update?system=dyndns&hostname=xxxxxt&myip=<a>
interval minimum 0 5 59 0
!
ip cef
no ipv6 cef

!
multilink bundle-name authenticated
!
!
cts logging verbose
license udi pid C897VA-K9 sn FCZ1942C3KG
!
!
controller VDSL 0
firmware filename flash:VA_A_39m_B_38h3_24h.bin
description Vdsl2 Swisscom
!
!
interface ATM0
no ip address
shutdown
no atm ilmi-keepalive
!
interface BRI0
no ip address
encapsulation hdlc
shutdown
isdn termination multidrop
!
interface Ethernet0
description InOne Swisscom
ip dhcp client broadcast-flag clear
ip dhcp client class-id 100008,0001,Cisco
ip ddns update hostname xxxxx
ip ddns update xxxxx
ip address dhcp
no ip redirects
no ip unreachables
ip pim sparse-mode
ip nat outside
ip virtual-reassembly in
ip igmp query-max-response-time 8
ip igmp version 3
ip igmp query-interval 10
ip igmp querier-timeout 60
load-interval 30
!
interface GigabitEthernet0
description WIFI-RSA master
switchport mode trunk
no ip address
!
interface GigabitEthernet1
description WIFI slave1
switchport mode trunk
no ip address
!
interface GigabitEthernet2
description WIFI slave2
switchport mode trunk
no ip address
!
interface GigabitEthernet3
switchport mode trunk
no ip address
!
interface GigabitEthernet4
description Switch ZyXel GS1910-24
no ip address
!
interface GigabitEthernet5
no ip address
!
interface GigabitEthernet6
no ip address
!
interface GigabitEthernet7
switchport mode trunk
no ip address
!
interface GigabitEthernet8
no ip address
duplex auto
speed auto
!
interface Vlan1
description default
ip address 10.1.0.1 255.255.0.0
ip pim sparse-mode
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
ip igmp helper-address 1.1.1.1
!
interface Vlan3
description Default.public
ip address 10.3.0.1 255.255.0.0
ip pim sparse-mode
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
ip igmp helper-address 1.1.1.1
!
interface Dialer0
no ip address
shutdown
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip dns server
ip pim rp-address 1.1.1.1
ip nat inside source list 1 interface Ethernet0 overload
!
!
access-list 1 permit 10.255.0.0 0.0.255.255
access-list 1 permit 10.0.0.0 0.255.255.255
!
control-plane
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
vstack
!
line con 0
no modem enable
line aux 0
line vty 0 4
transport input none
!
monitor session 1 source interface Gi0 - 6
monitor session 1 destination interface Gi7
scheduler allocate 20000 1000
ntp server ch.pool.ntp.org
!
end

[Richard Burts]

The original post contained error messages which included this " Low available memory:" The current poster says that they have the same issue, but did not include any error messages so it is difficult to know if it is precisely the same issue. Low available memory is frequently the result of a memory leak. If the current poster is indeed having the same issue then the optimum solution is to try a different version of code. If that is not possible then the available alternative is frequent rebooting of the router.

[awrutherford]

Interestingly I have a customer 887VAW router reporting the same problem, but the actual amount of free RAM on the router is higher than I would expect if it was an issue with total router memory. (Current 6M free, Lowest 3M free, Largest 2.5M free). Adding to the confusion is this router is a backup DNS server (third on the list handed out to clients via DHCP - the first two are local AD servers) and "show ip dns statistics" tells me it's had a grand total of only 134 requests of which 61 have been dropped in the six hours since it was last rebooted.

I suspect the DNS process has some kind of internal limit of the amount of RAM it will allocate, possibly related to the "ip dns server queue limit forwarder" config?

That said, I can't see anything in your config to specifically disallow external DNS requests to bounce of your router. Is it possible someone's using that router as a DNS proxy, and thus using more memory than you'd expect?

[paul driver]

Hello
Can you post in a file and attach to this OP
sh process memory
sh process memory shared
sh process cpu sorted

If you  disable DDNS does the router still report low memory?
Are you using the span ports for anything other than packet capturing?
What ios are yuo using, Have you tried upgrading?

Could you also try changing you nat access-list to accommodate only the specific internal subnet and apply a default route.
no access-list 1
access-list permit 10.1.0.0 0.0.255.255
access-list permit 10.3.0.0 0.0.255.255

ip route 0.0.0.0 0.0.0.0  eth0 dhcp

[romainsab84]

Hello,

Sorry for late answer, others problem to resolve at work.

i can't creat access permit list with IP only, i need to have "access-list 1", but i'm changing range.

I did upgrade to IOS 15.8(3)M4 and i deleted my ddns accoun, but it changing nothingt. In downgrading my torrent software, i don't have some others problem. i sent report problem to software compagny.