howdy ho,
But make sure you do:
config t
int null 0
no ip unreachables
The ACL drops are, last I checked, rate limit punts.
this is interesting - there is a good article detailing cef and CPU
punting at :-
http://searchnetworkingchannel.techtarget.com/generic/0,295582,sid100_gci1261924,00.html
Reading that and this posting begs the question
- if there is a lrage amount of ACL drops and these packets are punted to
cPU and the CPU rate-limit for punted packets has been exceeded, then
possible packets that need to be CPU processed will be dropped in favour
of ACL denied packets - this seems a bit ridiculous.
Any way to get acl dropped packets not to be CPU punted or to use
control-plane policing to discard them before they hit the CPU?
thanx
If it's high CPU at IP Input really need 12.4(20)T and get
a sniffer trace in the punt path to see what traffic it really is.
Rodney
On Thu, Sep 04, 2008 at 03:46:23PM -0400, Stephen Kratzer wrote:
On Thursday 04 September 2008 15:12:12 Mateusz B??aszczyk wrote:
2008/9/4 Stephen Kratzer :
The 'log' keyword will cause matching packets to not be CEF switched.
nope, log is not present.
Also, if
you're denying a lot of traffic from a certain source, you might want to
just bit-bucket it rather than sending ICMP responses.
you mean - "no ip unreachables"?
You could match the access list in a route map and set the outbound interface
to Null0.
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
---------------------------------------------------------------------
It's hard to be nostalgic when you can't remember anything good.
Nic Tjirkalli
Verizon Business South Africa
Network Strategy Team
Verizon Business is a brand of Verizon South Africa (Pty) Ltd. This e-mail
is strictly confidential and intended only for use by the addressee unless
otherwise indicated.
Company Information:http:// www.verizonbusiness.com/za/contact/legal/
This e-mail is strictly confidential and intended only for use by the
addressee unless otherwise indicated.
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
