How to troubleshoot high occupation rate of router CPU

Publication Date:  2012-07-27 Views:  118 Downloads:  0
Issue Description
 The occupation rate of CPU of R1760 amounts to 95%, and the software of the user is VRP1.74.

Alarm Information
No

Handling Process

After logon the equipment, executing dis ip fast cache command finds that both addresses of 192.168.0.30 and 192.168.0.32 are sending a large deal of packets with destination port as 1080.


[Router]dis ip fast cache                                                       

Fast-Forwarding cache:                                                         

 Index        SrIP     SrPort       DsIP     DsPort Pro Input_If  Output_If FLAG

    0:0    192.168.0.32  2006    218.74.45.61  1080   6  Ethernet1  Ethernet0 81

    0:1    192.168.0.30  2593     218.74.1.49  1080   6  Ethernet1  Ethernet0 81

    0:2    192.168.0.32  3159   218.74.49.189  1080   6  Ethernet1  Ethernet0 81

    0:3    192.168.0.30  3874     218.74.6.48  1080   6  Ethernet1  Ethernet0 81

    1:0    192.168.0.32  2134   218.74.45.189  1080   6  Ethernet1  Ethernet0 81

    1:1    192.168.0.30  3490    218.74.4.178  1080   6  Ethernet1  Ethernet0 81

    1:2    192.168.0.32  3031    218.74.49.61  1080   6  Ethernet1  Ethernet0 81

    1:3    192.168.0.30  3746    218.74.5.176  1080   6  Ethernet1  Ethernet0 81

    2:0    192.168.0.32  3415   218.74.50.189  1080   6  Ethernet1  Ethernet0 81

    2:1    192.168.0.30  1824   218.73.254.48  1080   6  Ethernet1  Ethernet0 81

    2:2    192.168.0.32  2262    218.74.46.61  1080   6  Ethernet1  Ethernet0 81

    2:3    192.168.0.30  2849     218.74.2.49  1080   6  Ethernet1  Ethernet0 81

    3:0    192.168.0.32  3287    218.74.50.61  1080   6  Ethernet1  Ethernet0 81

    3:1    218.74.48.71  1080  222.160.227.82 37298   6  Ethernet0  Ethernet1 41

    3:2    192.168.0.30  3618     218.74.5.49  1080   6  Ethernet1  Ethernet0 81

    3:3   218.74.49.221  1080  222.160.227.82 37988   6  Ethernet0  Ethernet1 41

    4:0    192.168.0.30  3106     218.74.3.50  1080   6  Ethernet1  Ethernet0 81

    4:1    192.168.0.32  2647   218.74.47.189  1080   6  Ethernet1  Ethernet0 81

    4:2    192.168.0.30  2081   218.73.255.49  1080   6  Ethernet1  Ethernet0 81

    4:3    192.168.0.32  2519    218.74.47.62  1080   6  Ethernet1  Ethernet0 81

    5:0    192.168.0.30  2978    218.74.2.178  1080   6  Ethernet1  Ethernet0 81

    5:1    218.74.6.173  1080  222.160.227.82 38638   6  Ethernet0  Ethernet1 41

    5:2    192.168.0.32  3544    218.74.51.62  1080   6  Ethernet1  Ethernet0 81

    5:3    192.168.0.32  1622   218.74.43.189  1080   6  Ethernet1  Ethernet0 81

    6:0    192.168.0.30  4131     218.74.7.49  1080   6  Ethernet1  Ethernet0 81

    6:1   218.74.46.112  1080  222.160.227.82 36379   6  Ethernet0  Ethernet1 41

    6:2    192.168.0.30  3362     218.74.4.50  1080   6  Ethernet1  Ethernet0 81

    6:3    192.168.0.32  2903   218.74.48.189  1080   6  Ethernet1  Ethernet0 81

    7:0    192.168.0.30  3234    218.74.3.178  1080   6  Ethernet1  Ethernet0 81

    7:1    192.168.0.32  2775    218.74.48.61  1080   6  Ethernet1  Ethernet0 81

This command is used to check the fast forwarding cache of the router. When the cache is full, the excceeding packets will be processed by CPU. In the case, the fast forwarding cache of the router is full, so the rest packets will be forwarded by CPU, resulting in that the occupation rate of CPU reaches 95%.

It is suggested to disable these two addresses. Thus, the problem is solved, and the occupation rate of CPU returns to normal. 

 


Root Cause
Attacked by virus.

END