Link layer loop used in CPU high rates of problem

Publication Date:  2012-12-18 Views:  249 Downloads:  0
Issue Description
Slower Internet connections, network port transceiver indicating lamp high frequency flicker.
Alarm Information
To view the CPU usage is high, higher than usual more than doubled.
Handling Process
To view the CPU usage found forwarding process CPU usage is high.
<USG2100>disp cpu   
09:01:15  2012/12/12          
CPU Usage Stat. Cycle: 60 (Second)       
CPU Usage            : 89% Max: 100%                  
CPU Usage Stat. Time : 2012-12-12  09:01:15      
CPU Usage Stat. Tick : 0xeec(CPU Tick High) 0x72079664(CPU Tick Low)          
Actual Stat. Cycle   : 0x0(CPU Tick High) 0x782026f5(CPU Tick Low)            
TaskName        CPU        Runtime(CPU Tick High/CPU Tick Low)                
DFWD            88%               0/720184a1           
Show interface flow information
<USG2100>disp interface brief                                                         
09:53:38  2012/12/12                                                          
PHY: Physical                                                                 
*down: administratively down                                                  
^down: standby                                                                
(s): spoofing                                                                 
InUti/OutUti: input utility/output utility                                    
Interface                      PHY   Protocol InUti       OutUti       inErrors  outErrors 
Cellular5/0/0               down  up(s)       0%       0%                    0          0 
Ethernet0/0/0               up    up              0%        0.01%              0          0 
Ethernet1/0/0               down  down     0%        0%                    0          0 
Ethernet1/0/1               up    up              0.02%  78%                  0          0 
Ethernet1/0/6               up    up             100%     100%              0          0 
Ethernet1/0/7               up    up             100%     100%              1          1 
Show interface flow found part of the interface flow is very large, there are two interface flow similar, if more than one interface flow were similar, indicating the presence of loop may.To view the Ethernet 1/0/6 and 1/0/7 found that the interface transceiver in large quantity per second, which is the embodiment of the loop characteristics.

<USG2100>disp inter ethernet 1/0/6                     
09:01:01  2012/12/12         
    Last 300 seconds input rate 42756224 bits/s, 83508 packets/s              
    Last 300 seconds output rate 42756224 bits/s, 83508 packets/s             
    Input: 48310854 packets, 3091894691 bytes           
           48310854 broadcasts, 0 multicasts             
    Output:48310856 packets, 3091894784 bytes          
           48310856 broadcasts, 0 multicasts      

Further information IP statistics, found the IP statistical information is not abnormal, the loop is a two layer loop caused by.
<USG2100>disp ip statistics                                                   
10:38:20  2012/12/12                                                          
  Input:     sum                401299      local                 137708               
             bad protocol           0           bad format               0                 
             bad checksum       0           bad options              0                 
             TTL exceeded    147345                                             
  Output:    forwarding          0          local                 147477                
             dropped                   0          no route            39535                 
  Fragment:  input                0           output                       0                 
             dropped                   0                                             
             fragmented             0           couldn't fragment    0                 
  Reassembling:sum           0           timeouts                   0                 

Unplug the ethernet1/0/7 or 1/0/6 network, found the loop was removed, interface traffic returned to normal, the rate of use of CPU also returned to normal range.
Confirm the loop is in the Ethernet 1/0/6 and 1/0/7 produced between the lines, further investigation, and found that the two interface is cable short circuit, the removal of the reticle, the network back to normal.
Root Cause
Itself of this kind of phenomenon description of the network flow is very large lead, have two kinds of reasons:
1) normal business flow is very large;
2) network loop.
When the network speed is very slow, the first to troubleshoot a system CPU utilization is normal, if the CPU usage is high, then further view which process is CPU high usage rate, if forwarding process CPU high usage rate, further investigation and forward the traffic flow is normal or loop condition exists, if the switch, hybrid switch can be checked, switches are generally have a loop detection mechanism, can be very convenient location out of the loop where the.