About nothing valuable when "show process cpu sorted"

[Qi Liu]

    This morning the CPU usage rate of my Cisco 2811 was constantly 99% , which caused lots of packets lost. When I used the command "show process cpu sorted ", I was quite confused that I couldn't find the process which was wasting the CPU resource. It seemed everything was OK.
    Later I doubted  too many NAT entries might cause the problem(over 60000 entries) , and almost all entries are sourced from the same IP and destined to TCP 3389 port of various Internet IP. 

    Everything came back OK after I blocked the host with the affected IP address.
    I want to know why I couldn't see the "nat" process is occupying most of the CPU resources. Wish any expert could help me , many thx.

[Joseph W. Doherty · Accepted solution]

Most of your CPU is being consumed by the interrupt software, which doesn't show as a separate process and often indicates you've hit the capacity limits of a software based router.  (How much traffic is flowing through the device at times like these?)

Second your IP process is consuming close to 20% which is relatively high.  That's process switching which is often is often about 10x less efficient for packet forwarding.  There are whitepapers on Cicso's main site that discuss troubleshooting high IP process.

[Qi Liu]

Hi Joseph , thx for your help . I'm now learning how to troubleshoot high IP process , and I can't understand what interrupt software is very well. Could you please help explain it ?