On Mon, 12 Feb 2001, Kevin Wigle wrote:
Dear group,
Investigating a router that is starting to loaded down. When I do a sh proc
cpu I get 50% or cpu utilization but the stats don't seem to add up to 50%.
Is there another way to try and see where the 50% is coming from?
sh proc cpu
CPU utilization for five seconds: 44%/44%; one minute: 50%; five minutes:
52%
The five second utilization numbers in the above line (44%/44%) represent
two things. The first number is total processor utilization and the
second is processor utilization due to interrupts. The difference in
these two numbers would be the sum of 5sec utilization by all other
processes.
If utilization due to interrupts increases over time, it represents
traffic growth. If it jumps alot in a short amount of time, it may be a
DoS attack. You can verify the latter by turning on "ip route-cache flow"
on suspected interfaces and then looking at the output of "sh ip cache
flow".
If the processor gets too high with legitimate traffic, you can use cef or
dcef (ip route-cache cef, ip cef distributed).
Failing that, you'll probably more beefy hardware.
Regards,
--phil
_________________________________
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
