Logs about hwCpcarDropPacketAlarm and hwCpcarAutoPortDefendAlarm

Created: Jan 20, 2020 03:44:24Latest reply: Jan 20, 2020 07:36:42 146 5 0 0
  Rewarded HiCoins: 0 (problem resolved)

Hello,

My customer encountered a problem.

He found logs about hwCpcarDropPacketAlarm and hwCpcarAutoPortDefendAlarm. Services which were not corresponding to the interface included in the hwCpcarAutoPortDefendAlarm logs, were also been affected. He checked the Zabbix, but from the Zabbix, the bandwidth usage of the interface, which did not generate the hwCpcarAutoPortDefendAlarm logs, was only about 23%.

He would like to clarify the difference between the hwCpcarDropPacketAlarm and hwCpcarAutoPortDefendAlarm, and why the packet dropping on the interface could affect other interface.

Thanks for any suggestions.


  • x
  • convention:

Featured Answers

Recommended answer

chenhui
Admin Created Jan 20, 2020 03:48:57 Helpful(2) Helpful(2)

Hello @user_3445655!
hwCpcarDropPacketAlarm is generated when the packets from all the interfaces exceed the threshold, while hwCpcarAutoPortDefendAlarm is generated when the packets from the local interface exceed the threshold.
When a protocol is enabled, the switch automatically assigns a queue to the protocol packets and a default CAR value for the queue. If a port receives many packets of a protocol and sends the packets to the CPU, the other ports will send the packets of this protocol to the CPU at a low speed or fail to send the packets to the CPU. This affects services.
After port-based automatic local attack defense is enabled, the switch moves the packets of this protocol to a queue with a small CAR value in either of the following situations:
1. The rate of such protocol packets received on a port exceeds 75% of the default CAR value.
2. The rate of such protocol packets received on the two ports that have received the most packets of this type exceeds 85% of the default CAR value.
This function ensures that other ports can normally send protocol packets to the CPU.

  • x
  • convention:

All Answers
chenhui
chenhui Admin Created Jan 20, 2020 03:48:57 Helpful(2) Helpful(2)

Hello @user_3445655!
hwCpcarDropPacketAlarm is generated when the packets from all the interfaces exceed the threshold, while hwCpcarAutoPortDefendAlarm is generated when the packets from the local interface exceed the threshold.
When a protocol is enabled, the switch automatically assigns a queue to the protocol packets and a default CAR value for the queue. If a port receives many packets of a protocol and sends the packets to the CPU, the other ports will send the packets of this protocol to the CPU at a low speed or fail to send the packets to the CPU. This affects services.
After port-based automatic local attack defense is enabled, the switch moves the packets of this protocol to a queue with a small CAR value in either of the following situations:
1. The rate of such protocol packets received on a port exceeds 75% of the default CAR value.
2. The rate of such protocol packets received on the two ports that have received the most packets of this type exceeds 85% of the default CAR value.
This function ensures that other ports can normally send protocol packets to the CPU.

  • x
  • convention:

user_3445655
user_3445655 Created Jan 20, 2020 05:41:21 Helpful(0) Helpful(0)

Posted by chenhui at 2020-01-20 03:48 Hello @user_3445655hwCpcarDropPacketAlarm is generated when the packets from all the interfaces exce ...
Can you give an example?
  • x
  • convention:

irfankhalid130
irfankhalid130 Created Jan 20, 2020 05:58:41 Helpful(0) Helpful(0)

There was a drop in between 4:am to 7:am in my Huawei SSD disk. I want to solve the issue so that it does not occur often. As well as i have updated coworking space in Noida on my website. Thank you.

  • x
  • convention:

chenhui
chenhui Admin Created Jan 20, 2020 07:35:06 Helpful(0) Helpful(0)

Posted by user_3445655 at 2020-01-20 05:41 Can you give an example?

Hi,

please check the example below.

For example, the cpu-defend policy configured as below,

cpu-defend policy te

car packet-type arp pps 300

car packet-type icmp pps 200

car all-packets pps 400

topo

If the arp packets received from G0/0/1 on SW1 reach 280pps which exceeds the 75% of 300, so the hwCpcarAutoPortDefendAlarm logs would generates to inform the administrator about the rate exceeding on G0/0/1. In this situation, if the rate of arp packets received from G0/0/2 is higher than 40pps, the whole rate would be higher than 320pps, which is 80% of 400, then the hwCpcarDropPacketAlarm logs would be generated to inform the administrator.


  • x
  • convention:

chenhui
chenhui Admin Created Jan 20, 2020 07:36:42 Helpful(0) Helpful(0)

Posted by irfankhalid130 at 2020-01-20 05:58 There was a drop in between 4:am to 7:am in my Huawei SSD disk. I want to solve the issue so that it ...
Hello,
I'm not clear about your problem from your description. Please create a post and describe your problem more detailed.
  • x
  • convention:

Comment

Reply
You need to log in to reply to the post Login | Register

Notice Notice: To protect the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but are not limited to the following:
  • Politically sensitive content
  • Content concerning pornography, gambling, and drug abuse
  • Content that may disclose or infringe upon others ' commercial secrets, intellectual properties, including trade marks, copyrights, and patents, and personal privacy
Do not share your account and password with others. All operations performed using your account will be regarded as your own actions and all consequences arising therefrom will be borne by you. For details, see " Privacy."
If the attachment button is not available, update the Adobe Flash Player to the latest version!

My Followers

Login and enjoy all the member benefits

Login and enjoy all the member benefits

Login