high CPU utilization (IOSd) on C4500.

[Nils Sandborg]

Hi, I've got a problem with two C4500-switches.

They both utilizing high CPU and the process thats responsible is IOSd (100% CPU on 1 core)

These 4500 are in two seperate networks with no physical connections to each other.

I can't see anything else strange if I look at the output from the following commands:

show proc cpu

show platform health

show platform cpu packet statistics 

I'll attach the output in txt-files.

There is only one thing I can notice, and it's these lines in the log:

001116: Nov  5 07:28:30.830: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 8172 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port TeX/10 in vlan XX

001117: Nov  5 13:29:06.007: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 47969 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port TeX/5 in vlan YY

001118: Nov  5 19:29:06.366: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 43970 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port TeX/10 in vlan XX

Can these packets from a 00:00:00:00:00 mac address affect the CPU?

[Leo Laohoo]

Can you please post the output to the command "sh proc cpu sorted | ex 0.00"?

[Nils Sandborg]

I'll have access to the equipment tomorrow again, so I will give you the output then.

Any other suggestions?

Do you think that the invalid mac addresses can cause high CPU load?

[InayathUlla Sharieff]

Hi Nils,

A packet was received with an all zero or a multicast source address. The packet is treated as invalid and no learning is done. Excessive flow of such packets can waste CPU cycles. This message is rate-limited and is displayed only for the first such packet received on any interface or VLAN. Subsequent messages will display cumulative count of all such packets received in given interval on all interfaces.

%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 1 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port X
These errors are only informative and are not directly related with the switch. The important thing is to find the source of the packet or the device that is sending the packet.
This indicates that a bad packet was received and was dropped. This could have been sourced as bad packet for different reasons; such as the size of Ethernet frame reported
different from expected IP packet size. The issue can be reported due to bad NIC cards, bad NIC drivers, or bad application.
This message is for informational purpose only. In older IOS versions, these packets are normally dropped without being logged.
If you are receiving a large amount of these errors you might try to track down the source device that is sending the erroneous packets, you'll need to use a network sniffer. You might also examine the adjacent Cisco device for other errors.
HTH

[ibrahimbadr4669]

what's the root cause of the high utilization