Hi everyone,
Our c3850's version is 16.6.5, however the cpu will reach to 100% occasionally
I have configured the event already,
event manager applet highcpu
event syslog pattern ".*SYS-1-CPURISINGTHRESHOLD.*"
action 4 cli command "monitor capture tac_cpu control-plane in match any file location flash:tac.pcap"
action 4.1 cli command "monitor capture tac_cpu limit packets 10000"
action 5 cli command "monitor capture tac_cpu start" pattern "yes"
action 6 cli command "yes"
action 7 wait 10
action 8 cli command "monitor capture tac_cpu stop"
action 9 cli command "no monitor capture tac_cpu"
here are the logs and capture
C3850#sho processes cpu sorted
CPU utilization for five seconds: 99%/60%; one minute: 61%; five minutes: 41%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
317 26489682 107584963 246 26.16% 11.33% 4.11% 0 SISF Switcher Th
230 154041163 209664649 734 7.00% 7.28% 7.09% 0 Spanning Tree
73 7785093 25031335 311 6.43% 2.75% 1.32% 0 IOSD ipc task
453 25524820 148828718 171 2.77% 2.29% 1.76% 0 SISF Main Thread
119 41006196 823190852 49 2.20% 1.89% 1.62% 0 IOSXE-RP Punt Se
37 14097674 46696433 301 0.89% 1.31% 1.12% 0 ARP Input
52 12403874 74316539 166 0.48% 0.91% 0.85% 0 ARP Snoop
C3850#sho monitor capture file flash:tac.pcap
5 0.011991 :: -> ff02::1:ffcb:11f8 ICMPv6 86 Neighbor Solicitation for fe80::b65d:50ff:fecb:11f8
6 0.012070 :: -> ff02::1:ffc6:6848 ICMPv6 86 Neighbor Solicitation for fe80::723a:eff:fec6:6848
7 0.012136 :: -> ff02::1:ffc6:68e2 ICMPv6 86 Neighbor Solicitation for fe80::723a:eff:fec6:68e2
8 0.012201 :: -> ff02::1:ffc6:68e2 ICMPv6 86 Neighbor Solicitation for fe80::723a:eff:fec6:68e2
9 0.012265 :: -> ff02::1:ffc6:6848 ICMPv6 86 Neighbor Solicitation for fe80::723a:eff:fec6:6848
10 0.012343 :: -> ff02::1:ffc6:68e2 ICMPv6 86 Neighbor Solicitation for fe80::723a:eff:fec6:68e2
11 0.012628 :: -> ff02::1:ffc6:683a ICMPv6 86 Neighbor Solicitation for fe80::723a:eff:fec6:683a
12 0.012697 :: -> ff02::1:ffc6:68ec ICMPv6 86 Neighbor Solicitation for fe80::723a:eff:fec6:68ec
13 0.012763 :: -> ff02::1:ffc6:6848 ICMPv6 86 Neighbor Solicitation for fe80::723a:eff:fec6:6848
14 0.012828 :: -> ff02::1:ffc6:683a ICMPv6 86 Neighbor Solicitation for fe80::723a:eff:fec6:683a
15 0.012892 :: -> ff02::1:ffc6:683a ICMPv6 86 Neighbor Solicitation for fe80::723a:eff:fec6:683a
16 0.012957 :: -> ff02::1:ffcb:11f8 ICMPv6 86 Neighbor Solicitation for fe80::b65d:50ff:fecb:11f8
17 0.013022 :: -> ff02::1:ffc6:68ec ICMPv6 86 Neighbor Solicitation for fe80::723a:eff:fec6:68ec
18 0.013086 :: -> ff02::1:ffcb:11f8 ICMPv6 86 Neighbor Solicitation for fe80::b65d:50ff:fecb:11f8
19 0.013151 :: -> ff02::1:ffc6:68ec ICMPv6 86 Neighbor Solicitation for fe80::723a:eff:fec6:68ec
20 0.022707 :: -> ff02::1:ffcb:11f8 ICMPv6 86 Neighbor Solicitation for fe80::b65d:50ff:fecb:11f8
21 0.022787 :: -> ff02::1:ffc6:68e2 ICMPv6 86 Neighbor Solicitation for fe80::723a:eff:fec6:68e2
----------------------------------omit---------------------------------------------
SO , I found lots of ICMPV6 Packet , it was very similar to a cisco bug CSCvk32439
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk32439/?rfs=iqvred
And I have created a ipv6 acl to deny all of the ipv6 traffic
C3850#sho ipv6 access-list
IPv6 access list DENY-IPV6
deny ipv6 any any (376843 matches) sequence 10
!
interface Vlan10
ip address 10.1.1.254 255.255.255.0
ipv6 traffic-filter DENY-IPV6 in
ipv6 traffic-filter DENY-IPV6 out
!
interface Port-channel100
switchport mode trunk
ipv6 traffic-filter DENY-IPV6 in
ipv6 traffic-filter DENY-IPV6 out
!
But it didn't work , CPU still reach to 100% occasionally
I had tried my best to find what cause this ....Can someone please assist me in the correct direction?
Thanks a lot
