Hey there,
In this post, let's talk about how to deal with the high CPU usage of the NE Router.
Common Causes of High CPU Usage on the MPU
Service packets: There are too many protocol packets, such as OSPF, IS-IS, and MPLS packets.
Attacks: Unidentified packets are sent to the CPU after network attacks are received.
Abnormal: The device chip is abnormal. Some tasks are used continuously., causing high CPU usage.
Common Causes of High CPU Usage on LPUs
Service packets: packets processed by interface boards, such as MAC address learning and ARP learning.
Abnormal: Some tasks are used continuously. For example, there are too many optical modules.
Run the display cpu-usage command to check the CPU usage of each module.
Common tasks that cause high CPU usage are as follows:
1. The PES, SOCK, ROUTE, and FIB tasks are high. The first task is sent by the NP, the second task is sent by the socket protocol, and the last two is the routing modules. Generally, this scenario appears when route flapping occurs.
2. The MACL task is high. This indicates that MAC address learning causes high CPU usage. Generally, the MAC address changes frequently or has defects.
3. The ARP task is high: There are too many ARP packets.
4. The diag is high: Causes by the optical module.
5. The trap task usage: Caused by too many traps sent to the NMS.
Fault locating for high CPU usage
1. Check whether the CPU usage of the LPU or MPU is high. This can be confirmed by the feature. For example, if route flapping occurs, the CPU usage of the MPU is high, and the CPU usage of the LPU is high if MAC address flapping occurs.
2. Determine the task with high CPU usage. Generally, the preceding tasks have high CPU usage.
3. Run the display cpu-defend all statistics slot X command to check whether a large number of protocol packets are sent to the CPU.
You can also run the CPU-defend car protocol command to view the protocol. Note that the ARP protocol is not included in the output of the preceding command .
[NE40E-2]dis cpu-defend car protocol?
802.1ag 8021AG protocol
arp ARP protocol
bfd BFD protocol
bgp BGP protocol
4. After determining the type of packets to be sent to the CPU, run the CPU-defend-policy command to decrease the bandwidth for sending packets to the CPU. Then, locate the fault.
5. Sometimes, a loop occurs on the device will cause the number of broadcast packets increases, and a large number of Hello packets such as MPLS, OSPF, and IS-IS packets are sent to the CPU, causing high CPU usage. In this case, run the display attack-source-trace slot x brief command (or use the verbose parameter) to displays information about attack source tracing.
<NE40E-2>dis attack-source-trace slot 1 brief
Info: Please waiting.........
No 1 Packet Info:
Interface Name: GigabitEthernet1/0/9.899
PeVlanid: 899
CeVlanid: 801
Attack Type: Application apperceive
Source Ip: 0.0.0.0
Dest Ip: 255.255.255.255
Source Port: 68
Dest Port: 67
Protocol Num: 17
Attack Pack Time: 2020-03-28 21:23:58
Attack Trace Data:
ff ff ff ff ff ff 00 1e 8c 46 48 99 81 00 03 83 81 00 03 21 08 00 45 00 01
48 ac ca 00 00 80 11 8c db 00 00 00 00 ff ff ff ff 00 44 00 43 01 34 6f 77
01 01 06 00 2c 76 73 5d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 1e 8c 46 48 99 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
----------------------------------
<NE40E-2>dis attack-source-trace slot 1 verbose
Info: Please waiting......
No 1 Packet Info:
Interface Name: GigabitEthernet1/0/9.899
PeVlanid: 899
CeVlanid: 801
Attack Type: Application apperceive
Attack Packet Time: 2020-03-28 13:23
L2 Type: Ethernet
Source Mac: 00-1e-8c-46-48-99
Dest Mac: ff-ff-ff-ff-ff-ff
Ethernet type: 8021Q
L3 Type: IP
Version: 4
Header Length: 5 byte
Type Of Service: 0
Total Length: 328
Identification: 44234
Fragment Offset: 0
TTL: 128
Protocol Num: 17
Checksum: 36059
Source Ip: 0.0.0.0
Dest Ip: 255.255.255.255
L4 Type: UDP
Source Port: 68
Dest Port: 67
Header Length: 308 byte
Checksum: 28535
Attack Trace Data:
ff ff ff ff ff ff 00 1e 8c 46 48 99 81 00 03 83 81 00 03 21 08 00 45 00 01
48 ac ca 00 00 80 11 8c db 00 00 00 00 ff ff ff ff 00 44 00 43 01 34 6f 77
01 01 06 00 2c 76 73 5d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 1e 8c 46 48 99 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
----------------------------------
