HIGH CPU occurs on cisco 4948e swtich due to L2 bridge to CPU of Cat4k Mgmt LoPri

[SANG-KYU KIM]

hi cisco specialists...

I have some problem about high cpu of 4948e. I found out that the switch occurs high cpu by L2 bridge to CPU. high cpu occurs about every four hours.

does anyone know what L2 bridge to CPU means? I googled it but I coundn't get anything related L2 bridge to CPU. to make thing worse, I can't get support from cisco tech... please help me.

please refer to the information below.

product : cisco 4948e

version : cat4500e-entservicesk9-mz.122-54.SG1.bin

Analysis Results

Jun 15 19:07:41.296: %SYS-1-CPURISINGTHRESHOLD: Threshold: Process CPU Utilization(Total/Intr): 90%/0%, Top 3 processes(Pid/Util):  60/84%, 59/4%, 121/0%

60   501895823 736282250        681  6.23%  5.62%  5.32%   0 Cat4k Mgmt LoPri

-> I couldn't get the status of high cpu that's because it occurs intermittently but I know that it occurs high cpu by log above

K5CpuMan Review       30.00   9.84     30     55  100  500    8   6    4  13825:01

Queue                  Total           5 sec avg 1 min avg 5 min avg 1 hour avg
---------------------- --------------- --------- --------- --------- ----------
Input ACL fwd(snooping)       198845718        34        22        20          8
L2 bridge to CPU, 0         1659668688       102       101        76         58
Host Learning                  1568026         0         0         0          0
L2 Control                   401188332        25        21        16          8
Ttl Expired                         26         0         0         0          0
L2 router to CPU, 7           40302080         0         0         0          0
L3 Glean, 7                          9         0         0         0          0
L3 Receive, 7                 32509074         2         0         0          0

please let me know what L2 bridge to CPU means... It's urgent problem for me.

if you need more information,  please leave me a comment (I can't use span technology that's because the switch is located abroad....) 

[Matt Delony]

Hello,

Top CPU process was "Cat4k Mgmt LoPri". This means that you need to check "show platform health" next.

When a mgmt process actual CPU% goes above the target listed for that process, it is then considered low priority and can make the "Cat4k Mgmt LoPri" CPU process go high.

It looks like you may have already checked the output. Was "K5CpuMan Review" exceeding its target CPU%? If it was, this means that a large amount of traffic was being sent to CPU for processing.

I believe "L2 bridge to CPU" refers to a few things:

• Protocols that are not supported in hardware, such as IPX and AppleTalk routed packets, are bridged to the CPU
• ARP request and response
• Packets with a destination MAC address of the switch SVI⁶/L3 interface are bridged if the packets cannot be routed in hardware because of:
  • IP header options
  • Expired TTL⁷
  • Non-ARPA encapsulation

(Reference)

My next step for troubleshooting would usually be to take an in-built CPU sniffer when the high CPU is occurring, to identify the details of the excessive traffic hitting CPU (Reference). It would help identify src/dst mac/IP details, source interface, reason for CPU processing, etc.

Since the high CPU utilization is intermittent, it's tough to collect this information when the problem is occurring. I would usually recommend an EEM script to collect the necessary outputs when the CPU utilization goes high.

If the issue occurs every 4 hours, could this be related to ARP timeout? Does the 4948 have a lot of ARP entries and they all get refreshed every 4 hours at the same time?