I have found the answer.
There is a document on CCO
Troubleshooting High CPU Utilization for Cat 3750 which is brilliant. The queues are in order from 0 -15:
These are the CPU queues with their uses:
•
rpc—Remote procedure call. Used by Cisco system processes to communicate across the stack.
•
stp—Spanning Tree Protocol. A Layer 2 protocol with its own queue.
•
ipc—Interprocess communication. Used by Cisco system processes to communicate across the
stack.
•
routing protocol—Used for routing protocol packets received by other network devices.
•
L2 protocol—Used for protocol packets such as LACP, UDLD, and so on.
•
remote console—Used for packets when you enter the session switch-number privileged EXEC
command on a stack master switch to open the console on another switch member.
•
sw forwarding—Used for packets punted by the hardware for the CPU to route.
•
host—Used for packets with a destination IP address matching any switch IP address. Also IP
broadcast packets.
•
broadcast—Receives Layer2 broadcast packets.
•
cbt-to-spt—Receives multicast packets for PIM_SM.
•
igmp snooping—A queue for IGMP packets.
•
icmp—A queue for ICMP redirect packets.
•
logging—Used for receive packets generated by hardware for ACL logging.
•
rpf fail—A queue for reverse path forwarding failures.
•
dstats—drop stats. Not used during normal operation.
•
cpu heartbeat—Used by the CPU receiving the packets it sends to itself.
The high count was due to services on a CSS with keepalive but the network not in the routing tables as servers moved long time ago and so the CSS was sending packets to a supernet which were forwarded to my device and back so in a loop until ttl expired but as keepealives with many services on two CSS there were many packets.
My issue was icmp queue 11 and is now sorted. This can be considered closed. I'll give myself 5 stars I think.
