NOTE
CPU usage of 70% does not necessarily affect services. Services may not be affected when some tasks
consume 70% of CPU resources, but may be affected when some tasks consume 30% of CPU resources.
This outcome depends on the actual situation.
Step 2 Check whether a large number of packets are sent to the CPU.
Run the display cpu-defend statistics command to check statistics about the packets sent to the
CPU and focus on the Drop field.
<Huawei> display cpu-defend statistics all
-----------------------------------------------------------------------
Packet Type Pass Packets Drop Packets
-----------------------------------------------------------------------
8021X 0 0
arp-miss 1 0
arp-reply 5 0
arp-request 1450113 25597
bfd 0 0
bgp 0 0
dhcp-client 114693 136586
dhcp-server 0 0
dns 0 0
fib-hit 0 0
ftp 717 0
fw-dns 0 0
fw-ftp 0 0
fw-http 0 0
fw-rtsp 0 0
fw-sip 0 0
gvrp 0 0
http 798 0
hw-tacacs 0 0
icmp 10 0
igmp 0 0
ipsec 0 0
isis 0 0
lacp 0 0
lldp 33959 0
ntp 0 0
ospf 1569 0
pim 0 0
pppoe 0 0
radius 0 0
rip 0 0
snmp 0 0
ssh 0 0
stp 0 0
tcp 7671 0
telnet 71149 0
ttl-expired 656 0
udp-helper 0 0
unknown-multicast 6 0
unknown-packet 94189 0
vrrp 0 0
-----------------------------------------------------------------------
l If the value of the Drop field of a certain type of packets is great and CPU usage is high,
packet attacks occur. Go to step 6.
l If the value of the Drop field is within the specified range, go to step 3.
Step 3 Check whether a large number of TC packets are received.
If STP is enabled on a device, the device deletes MAC address entries and ARP entries when
receiving TC-BPDUs. If an attacker sends pseudo TC-BPDUs to attack the device, the device
will receive a large number of TC-BPDUs within a short period and frequently deletes MAC
address entries and ARP entries. As a result, the device CPU usage becomes high.
Huawei AR2200-S Series Enterprise Routers
Troubleshooting 2 System
Issue 01 (2012-01-06) Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
8
To Next Page
Loading...
