Mailing List Archive: Cisco: NSP

TCP Timer 70% CPU

Index | Next | Previous | View Threaded

savage at savage

Aug 13, 2012, 12:39 AM

Post #1 of 7 (686 views)
Permalink

TCP Timer 70% CPU

Hi All,

I have a Cisco 3825 with 1GB Ram doing some BGP peering (VERY low
traffic, not even 5mbit/s sustained throughput). Memory usage is
absolutely fine and sitting at less than 50% utilization, and stable.

The Router's CPU is showing an almost linear increases, and the 'TCP
Timer' process is currently sitting at over 70% CPU load. Cisco
documentation suggests:
TCP Timer

When the Transmission Control Protocol (TCP) timer process uses a lot
of CPU resources, this indicates that there are too many TCP
connection endpoints. This can happen in data-link switching (DLSw)
environments with many peers, or in other environments where many TCP
sessions are simultaneously opened on the router.

What does this actually mean? The router does not make any TCP
connections (nor does it receive any - except for the odd telnet to
VTY). Radius and Syslog is enabled however, but this is sending UDP
traffic...

What can I look at possibly to determine root cause and fix?

--

Regards,
Chris Knipe
_______________________________________________
cisco-nsp mailing list cisco-nsp [at] puck
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

rdobbins at arbor

Aug 13, 2012, 12:46 AM

Post #2 of 7 (653 views)
Permalink

Re: TCP Timer 70% CPU [In reply to]

On Aug 13, 2012, at 2:39 PM, Chris Knipe wrote:

> What can I look at possibly to determine root cause and fix?

Have you iACLed the router so that randoms from the Internet/your customer base can't connect to it?

-----------------------------------------------------------------------
Roland Dobbins <rdobbins [at] arbor> // <http://www.arbornetworks.com>

Luck is the residue of opportunity and design.

-- John Milton

_______________________________________________
cisco-nsp mailing list cisco-nsp [at] puck
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

timoid at timoid

Aug 13, 2012, 12:48 AM

Post #3 of 7 (644 views)
Permalink

Re: TCP Timer 70% CPU [In reply to]

> I have a Cisco 3825 with 1GB Ram doing some BGP peering (VERY low
> traffic, not even 5mbit/s sustained throughput). Memory usage is
> absolutely fine and sitting at less than 50% utilization, and stable.
>
> The Router's CPU is showing an almost linear increases, and the 'TCP
> Timer' process is currently sitting at over 70% CPU load. Cisco
> documentation suggests:
> TCP Timer
>
> What can I look at possibly to determine root cause and fix?
>

Hi Chris,

Any chance one of your BGP sessions are down?

_______________________________________________
cisco-nsp mailing list cisco-nsp [at] puck
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

savage at savage

Aug 13, 2012, 1:31 AM

Post #4 of 7 (645 views)
Permalink

Re: TCP Timer 70% CPU [In reply to]

Hi,

Saw 4 sessions that was down and "sh tcp" showed thousands of
connections in a CLOSEWAIT state to those neighbors. I presume that's
my culprit.

I shutted the neighbors that was down, but the connections are still
in an CLOSEWAIT - looking now to see about resetting them. CPU usage
for the process is slowly starting to come down though, presumably the
connections are timing out and not being re-created.

Many thanks,
Chris.

On Mon, Aug 13, 2012 at 9:48 AM, Tim Warnock <timoid [at] timoid> wrote:
>> I have a Cisco 3825 with 1GB Ram doing some BGP peering (VERY low
>> traffic, not even 5mbit/s sustained throughput). Memory usage is
>> absolutely fine and sitting at less than 50% utilization, and stable.
>>
>> The Router's CPU is showing an almost linear increases, and the 'TCP
>> Timer' process is currently sitting at over 70% CPU load. Cisco
>> documentation suggests:
>> TCP Timer
>>
>> What can I look at possibly to determine root cause and fix?
>>
>
> Hi Chris,
>
> Any chance one of your BGP sessions are down?
>
> _______________________________________________
> cisco-nsp mailing list cisco-nsp [at] puck
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

--

Regards,
Chris Knipe
_______________________________________________
cisco-nsp mailing list cisco-nsp [at] puck
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

jstuxuhu0816 at gmail

Aug 13, 2012, 8:49 AM

Post #5 of 7 (638 views)
Permalink

Re: TCP Timer 70% CPU [In reply to]

Is anyway we can see the tcp connections in the router through show tcp or something like that?

Thanks and regards,
Xu Hu

On 13 Aug, 2012, at 16:31, Chris Knipe <savage [at] savage> wrote:

> Hi,
>
> Saw 4 sessions that was down and "sh tcp" showed thousands of
> connections in a CLOSEWAIT state to those neighbors. I presume that's
> my culprit.
>
> I shutted the neighbors that was down, but the connections are still
> in an CLOSEWAIT - looking now to see about resetting them. CPU usage
> for the process is slowly starting to come down though, presumably the
> connections are timing out and not being re-created.
>
> Many thanks,
> Chris.
>
>
>
> On Mon, Aug 13, 2012 at 9:48 AM, Tim Warnock <timoid [at] timoid> wrote:
>>> I have a Cisco 3825 with 1GB Ram doing some BGP peering (VERY low
>>> traffic, not even 5mbit/s sustained throughput). Memory usage is
>>> absolutely fine and sitting at less than 50% utilization, and stable.
>>>
>>> The Router's CPU is showing an almost linear increases, and the 'TCP
>>> Timer' process is currently sitting at over 70% CPU load. Cisco
>>> documentation suggests:
>>> TCP Timer
>>>
>>> What can I look at possibly to determine root cause and fix?
>>>
>>
>> Hi Chris,
>>
>> Any chance one of your BGP sessions are down?
>>
>> _______________________________________________
>> cisco-nsp mailing list cisco-nsp [at] puck
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
>
> --
>
> Regards,
> Chris Knipe
> _______________________________________________
> cisco-nsp mailing list cisco-nsp [at] puck
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

_______________________________________________
cisco-nsp mailing list cisco-nsp [at] puck
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

iftikhar.mehar at maxima

Aug 13, 2012, 9:25 AM

Post #6 of 7 (639 views)
Permalink

Re: TCP Timer 70% CPU [In reply to]

show ip sockets

Regards,
Iftikhar

-----Original Message-----
From: cisco-nsp-bounces [at] puck
[mailto:cisco-nsp-bounces [at] puck] On Behalf Of Xu Hu
Sent: 13 August 2012 16:50
To: Chris Knipe
Cc: cisco-nsp [at] puck
Subject: Re: [c-nsp] TCP Timer 70% CPU

Is anyway we can see the tcp connections in the router through show tcp
or something like that?

Thanks and regards,
Xu Hu

On 13 Aug, 2012, at 16:31, Chris Knipe <savage [at] savage> wrote:

> Hi,
>
> Saw 4 sessions that was down and "sh tcp" showed thousands of
> connections in a CLOSEWAIT state to those neighbors. I presume that's

> my culprit.
>
> I shutted the neighbors that was down, but the connections are still
> in an CLOSEWAIT - looking now to see about resetting them. CPU usage
> for the process is slowly starting to come down though, presumably the

> connections are timing out and not being re-created.
>
> Many thanks,
> Chris.
>
>
>
> On Mon, Aug 13, 2012 at 9:48 AM, Tim Warnock <timoid [at] timoid>
wrote:
>>> I have a Cisco 3825 with 1GB Ram doing some BGP peering (VERY low
>>> traffic, not even 5mbit/s sustained throughput). Memory usage is
>>> absolutely fine and sitting at less than 50% utilization, and
stable.
>>>
>>> The Router's CPU is showing an almost linear increases, and the 'TCP

>>> Timer' process is currently sitting at over 70% CPU load. Cisco
>>> documentation suggests:
>>> TCP Timer
>>>
>>> What can I look at possibly to determine root cause and fix?
>>>
>>
>> Hi Chris,
>>
>> Any chance one of your BGP sessions are down?
>>
>> _______________________________________________
>> cisco-nsp mailing list cisco-nsp [at] puck
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
>
> --
>
> Regards,
> Chris Knipe
> _______________________________________________
> cisco-nsp mailing list cisco-nsp [at] puck
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

_______________________________________________
cisco-nsp mailing list cisco-nsp [at] puck
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

This message has been scanned for malware by Websense. www.websense.com

DISCLAIMER:This message is intended only for the use of the person(s) ("the intended recipient(s)") to whom it is addressed. It may contain information which is privileged, proprietary and/or confidential within the meaning of applicable law. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing or copying of this message (including any attachments) is strictly prohibited. If you have received this message in error, please contact the sender of this message as soon as possible. The views or opinions expressed in this message are those of the author and may not necessarily be the views held by Maxima Holdings plc.Maxima Holdings plc. Cotswold Court, Lansdown Road, Cheltenham, Glos, GL50 2JA. Registered in England. 5043538. VAT Number - 728778184

This message has been scanned for malware by Websense. www.websense.com

_______________________________________________
cisco-nsp mailing list cisco-nsp [at] puck
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

jared at puck

Aug 13, 2012, 9:41 AM

Post #7 of 7 (637 views)
Permalink

Re: TCP Timer 70% CPU [In reply to]

'show ip sockets' is the UDP ports.

'show tcp brief all' will show all TCP sessions including the listeners.

It should be known that there are some applications that wont register with the TCP/UDP handlers so may not appear as well. This is generally unlikely for you..

- Jared

On Aug 13, 2012, at 12:25 PM, Iftikhar Mehar wrote:

> show ip sockets
>
> Regards,
> Iftikhar
>
> -----Original Message-----
> From: cisco-nsp-bounces [at] puck
> [mailto:cisco-nsp-bounces [at] puck] On Behalf Of Xu Hu
> Sent: 13 August 2012 16:50
> To: Chris Knipe
> Cc: cisco-nsp [at] puck
> Subject: Re: [c-nsp] TCP Timer 70% CPU
>
> Is anyway we can see the tcp connections in the router through show tcp
> or something like that?
>
> Thanks and regards,
> Xu Hu
>

_______________________________________________
cisco-nsp mailing list cisco-nsp [at] puck
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads