The handling process of a cisco6509 High cpu Fault

Cisco6509 version cisco WS-C6509-V-E (R7000) processor (revision 1.0)

Ios version sup-bootdisk:s72033-advipservicesk9_wan-mz.122-33.SXI3.bin

Through the monitoring server, it is found that the utilization rate of cpu is more than 85%, as shown in the following figure

Log in to cisco6509 and use the command show proc cpu sort 5min | e 0.0 (this command is very important, you can type the first three words), and find that the arp input is very high, five seconds: 31% (crazy). According to the usual practice, show logging first to see if there is any abnormal address in trouble. Unfortunately, there is no useful information, so you can only start to mirror and grab the package. What's more, I spent a long time trying not to find any abnormal ip address and was at a loss what to do. Suddenly remembered that there is a big brother, debug (starling), enter the command debug arp, to pay attention to be short, (after a long time can only cry, cry, not sad, is not connected) finally see the dawn, as shown in the picture

If it is ip input Gao, you can use debug ip packet detail (remember, send the eldest brother away after use, undebug all)

When the reason is found, the fight begins, the second half of the 11 segments is skimmed out, and the corresponding vlan,cpu on the switch returns to normal, which is the latter segment seen in the top picture. If you use the command show proc cpu sort 5min to see that the main reason for the high cpu is the high cpu caused by ipv6 input as shown in the figure below, you need to enter ipv6 mld snooping in the conf t mode of cisco6509 to enable multicast suppression (this command is generally used on layer 2 switches) to significantly reduce the cpu share, as shown in the following two figures.