Mailing List Archive

Id suggest first you examine the output of show interfaces
switching, that should tell you which interfaced is getting the
highest traffic hits. then show ip interface and check for the
switching method employed on the interface. That would be a good
beginning, In general, there's a chance that the router is
process-switching most of the traffic hence all you'll probably
need to do is probably re-enable interrupt switching on the
interface/s concerned.

For further reading ...please have a look at the following:
http://www.cisco.com/warp/public/63/highcpu_ip_input.html#pre

**Gitau

_____

From: cisco-nas-bounces@puck.nether.net
[mailto:cisco-nas-bounces@puck.nether.net] On Behalf Of Souphonh
Sent: Friday, January 28, 2005 10:09 AM
To: cisco-nas@puck.nether.net
Subject: [cisco-nas] High CPU usage on IP INPUT process


Dear Sir,

I am using Cisco 3620, IOS 12.2-17 as NAT, and found that the CPU
utilisation for IP INPUT is very high. I need to clear IP NAT
TRANSLATION every day. Could you please suggest how can I check
for the cause of high CPU utilisation.

Regards,
Souphonh

Hi,

On Fri, Jan 28, 2005 at 02:09:13PM +0700, Souphonh wrote:
> I am using Cisco 3620, IOS 12.2-17 as NAT, and found that the CPU utilisation for IP INPUT is very high. I need to clear IP NAT TRANSLATION every day. Could you please suggest how can I check for the cause of high CPU utilisation.

We've recently discovered that 12.2 seems to be affected by CSCsa51150
as well:

On a customer 1600, upgrading IOS from 12.0->12.2 made the NAT table
virtually explode. All entries were legitimately-looking web sessions,
but the translation entries just did not go away after the TCP FIN came
along - the bug ID above lists only 12.3(x) as affected, so we're not
fully sure whether it's the same bug, but it's definitely the same
behaviour.

Symptoms are similar: high CPU load, large NAT table, "clear ip nat tra *"
makes it go away for a few hours, then the CPU load is up again (while
the number of NAT translation entries grows and grows and grows...).

We downgraded back to 12.0(recent), and haven't seen any NAT issues on
that router since.

gert


--
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany gert@greenie.muc.de
fax: +49-89-35655025 gert@net.informatik.tu-muenchen.de

Gert Doering [gert@greenie.muc.de] wrote:
> Hi,
>
> On Fri, Jan 28, 2005 at 02:09:13PM +0700, Souphonh wrote:
> > I am using Cisco 3620, IOS 12.2-17 as NAT, and found that the CPU utilisation for IP INPUT is very high. I need to clear IP NAT TRANSLATION every day. Could you please suggest how can I check for the cause of high CPU utilisation.
>
> We've recently discovered that 12.2 seems to be affected by CSCsa51150
> as well:
>
> On a customer 1600, upgrading IOS from 12.0->12.2 made the NAT table
> virtually explode. All entries were legitimately-looking web sessions,
> but the translation entries just did not go away after the TCP FIN came
> along - the bug ID above lists only 12.3(x) as affected, so we're not
> fully sure whether it's the same bug, but it's definitely the same
> behaviour.

It is the same bug but we missed the commit to 12.2. I'll contact the
DE to get this done ASAP. Thanks for bringing it up.

Dennis

> Symptoms are similar: high CPU load, large NAT table, "clear ip nat tra *"
> makes it go away for a few hours, then the CPU load is up again (while
> the number of NAT translation entries grows and grows and grows...).
>
> We downgraded back to 12.0(recent), and haven't seen any NAT issues on
> that router since.
>
> gert
>
>
> --
> USENET is *not* the non-clickable part of WWW!
> //www.muc.de/~gert/
> Gert Doering - Munich, Germany gert@greenie.muc.de
> fax: +49-89-35655025 gert@net.informatik.tu-muenchen.de
> _______________________________________________
> cisco-nas mailing list
> cisco-nas@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nas

Hi,

On Fri, Jan 28, 2005 at 10:57:24AM -0800, Dennis Peng wrote:
> > We've recently discovered that 12.2 seems to be affected by CSCsa51150
> > as well:
>
> It is the same bug but we missed the commit to 12.2. I'll contact the
> DE to get this done ASAP. Thanks for bringing it up.

Cool - thank *you* for picking this up, looking it up, and getting it
fixed :-)

(The bug has been sitting on my desk, waiting for me to open a TAC case,
but I haven't found time to build a testbed and actually reproduce things
before opening a case on it...)

gert

--
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany gert@greenie.muc.de
fax: +49-89-35655025 gert@net.informatik.tu-muenchen.de