Cisco 4500 intermittent high CPU utilization

We found more information. It turns out that the Router Alert packets not the cause of the use of loud, but mearly a piece of the larger puzzle.

The problem of CPU usage has become so unbearable that something had to be done, and unfortunately, the modification of all Macintosh systems on the network via mDNS was not an option. Some systems have been altered without significant impact, but it could be because the number of systems changed less than 1% of the systems formed in this campus. Instead something else could be tried … Somthing on the web …

Be certain that the previous repair was correct, and with the assurance that nothing but the production was GhostCast use of multicast, multicast routing is enabled on the switch-off. It was a bold and rather drastic, but it should solve the problem, right? Wrong. The number of packages to beat the CPU with the Router Alert option has remained constant, and the CPU usage still behave as if it was before. If I thought thiss a little more, I realized that the movement when used on the multicast address 224.0.0.x/24 area remain in place to ensure that trade will deteriorate further.

The next step was to access a list of this group to create blocks mDNS the destination address. After that is created, it added a LCD port on each switch port customer response. Suddenly, we now have a real change of status. CPU usage rose 100% to 21% if the serial interface command has been completed.

The big question here is why this work, and what has caused the bad performance switch? The 4500 is suited to a much higher volume of multicast traffic, and distributed processing hardware multicast. It turns out the area for the local 224.0.0.0/24 L2 multicast, such as routing protocols, routers, all the guests, etc. This fact has been reserved for 4500 to determine all multicast traffic to every email address in this field directly on the CPU, the weather, it is necessary / was fired or not. I think an incoming multicast filtering 224.0.0.0/24 should be a prerequisite for the security of each network to DoS accidental or deliberate cons infrastructure to prevent the weather is officially independent multicast in use on web!