High CPU utilisation on WS-4948E

[mmelbourne]

We are seeing high utilisation on a number of 4948E switches, running 12.2(54)SG1.

The output of "show proc cpu sorted" shows:

switch# sh proc cpu sort

CPU utilization for five seconds: 96%/0%; one minute: 95%; five minutes: 96%

PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process

  57  25513895681506739659       1693 93.75% 93.04% 93.54%   0 Cat4k Mgmt LoPri

Looking at the following document:

http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/troubleshooting/cpu_util.html

The process which stands out from the output of "show platform health" is "K5 L2 Hardware Addre".

In the output of "show platform cpu packet statistics all", the only significant value is:

Queue                  Total           5 sec avg 1 min avg 5 min avg 1 hour avg

---------------------- --------------- --------- --------- --------- ----------

Input ACL fwd(snooping)      3259936775       685       636       537        522

The switch has a 2*10Gbps vPC to an upstream Nexus 7k pair carrying a number of VLANs (for which there will be HSRP traffic). Could it be that HSRP traffic destined to the all routers multicast address is being punted to the switch's CPU?

Thanks,

Matt

[Somasundaram Jayaraman]

Hi,

You can use the below mentioned commands to check the source mac, destination mac, source ip & destination of the packets hitting the CPU.

Switch#debug platform packet all receive buffer
platform packet debugging is on
Switch#show platform cpu packet buffered

http://www.cisco.com/en/US/products/hw/switches/ps663/products_tech_note09186a00804cef15.shtml

Hope this helps.

Cheers

Somu

Rate helpful posts

[andtoth]

Hi Matt,

All routers multicast addresses packets are indeed punted to the switch CPU. On the 4500 platform this is done in a global way by default. You can configure per-vlan interception of these packets. However note that if you have an SVI (Vlan interface) for that vlan, packets will be punted to the CPU.

Please refer to the following documentation which explains this behavior in more detail:

http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/54sg/configuration/guide/secure.html#wp1128851

You can use the access-list hardware capture mode global configuration command to change the ACL capture mode.

Best regards,

Andras