Many Catalys 3850 switches Auto-reload

[seazhangwei]

We are facing Many C3850 switches auto-reload , before reload ,cpu load was high abnormally .

current image is  flash:cat3k_caa-universalk9.SPA.03.06.08.E.152-2.E8.bin

121121211119
807627277789
100 *
90 *
80 *
70 *
60 *
50 *
40 *
30 *
20 ************
10 ############
0....5....1....1....2....2....3....3....4....4....5....5....6....6....7.
0 5 0 5 0 5 0 5 0 5 0 5 0
CPU% per hour (last 72 hours)
* = maximum CPU% # = average CPU%

1 11 4 1 1
637344252532428534321619554633325652352126588244134433422539
100
90
80
70
60
50 *
40 *
30 *
20 ** * *
10 * * * * ** ***** * *** * ***** * *
0....5....1....1....2....2....3....3....4....4....5....5....
0 5 0 5 0 5 0 5 0 5
CPU% per minute (last 60 minutes)
* = maximum CPU% # = average CPU%

[Philip D'Ath]

You should probably move onto a more recent version of code like 3.6.9E.

https://software.cisco.com/download/home/284455425/type/282046477/release/3.6.9E

[Philip D'Ath]

Have you done a "no vstack" on your switches?

There is a known vulnerability that allows remote unauthenticated attackers to run commands, and I have seen a couple of cases there this has been used to remotely reboot switches.

[Leo Laohoo]

Post the complete output to the command "sh vstack config".
(I've stumbled upon a thread (non-Cisco) where two users have reported that someone is using the SmartInstall exploit against them.)