Great, so now I know: from 'show ip cef switching stat' I learned that there is a large number of packets with an expired TTL (TTL-expired is handled by the IP process, ie. software routing)
from 'show interface switching' (hidden command) I learned the interface that has a high number of packets In and packets Out in the row "IP Process" Since the number of packets in the two commands above are very close to each other, I think I have identified the network interface with the large number of TTL-expired packets. It is a BGP interface, so my best guess is that a BGP neighbour is advertising routes that they don't actually carry in their routing tables and for some reason they are sending the packets back to me, and the question now is to locate the culprit route advertisement and contact the neighbor. Right? Still, for the next time I see high cpu usage, the commands to use are: 'show process cpu' and look at the first few lines to determine if it's interrupts or processes consuming the cpu time. If it's processes, look at the list of processes for any that are using large percentages. To diagnose high cpu consumption by interrupts, CPU Profiling (http://www.cisco.com/en/US/products/hw/routers/ps359/products_tech_note09186a00801c2af0.shtml) is a possible tool. Thank you all for your help! Hector _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
