cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
599
Views
10
Helpful
9
Replies

Telnet traffic going to WS-4948 CPU

hekho
Level 1
Level 1

Hi,

a Catalyst 4948 has CPU usage rising above our Alarm treshold (60%).

It does no harm to the production but I was curious and investigated the phenomenon.

I followed the troubleshooting path presented in this document https://www.cisco.com/c/en/us/support/docs/switches/catalyst-4000-series-switches/65591-cat4500-high-cpu.html.

I started to monitor the traffic send to the CPU and found several telnet session between a machine and several Cisco 25xx Terminal Servers.

I am surprised to see that kind of traffic forwarded at the CPU level. Does anybody has an explaination for that ?

 

Thanks

Hekho

 

 

9 Replies 9

luis_cordova
VIP Alumni
VIP Alumni

Hi @hekho ,

 

Check this link:

https://www.cisco.com/c/en/us/support/docs/routers/7500-series-routers/41100-highcpu-exec.html

 

It has some information that could guide you with your doubt.

 

Regards

Hi,

 

thanks for your recommendation. I have to say the Catalyst itself is not involved in the telnet sessions.

The CPU rise seems to be correlated by Layer-2 forwarding as showned by K2CpuMan Review at the of CPU usage.

 

Thank you very much.

 

Hekho

What IOS version is the appliance running on?

Thank you for your participation. The cat is running that old lady:  cat4000-i9s-mz.122-25.EWA11.bin

Would it make any difference if I say "upgrade the IOS"?

Ha ha. At the moment that's not an option otherwise I would have done it already :-D

And as I wrote, there's no impact on the production. The goal here is to understand why on earth telnet traffic and also LDAP make their way to the the CPU. That does not make sense to me.

It goes to the CPU because the CPU deals with any processing not dealt with by special/dedicated (e.g. ASIC) hardware (which generally only handles "typical" data plane traffic).

Thanks for your comment. The telnet traffic I am talking about involves servers on the network not the switch itself. As far as I know, that should belong to data plane.

Yes, if the telnet traffic is "transit", it should be processed like other transit (data plane) traffic. However, if there is something odd/unusual about those telnet packets, odd/unusual packets are punted up to the main CPU.

BTW, what's considered odd/unusual in packets can change with IOS versions, so Leo's suggestion to upgrade the IOS might be even more relevant.
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: