9

Please suggest, we are getting UDP traffic either broadcast or multicast in router 2911 which cause 95%+ utilisation of the router. And we got error in link and business impact due to this. Company has stock exchange business and nano sec downtime worries for us. Please suggest how to control unwanted traffic coming in to cisco router 2911?

Other surprising thing, servers communicated with through LAN network only but why Router CPU utilisation got increased? Sharing router configuration if you found some missing or over configuration which helps to understand better. Highly appreciate your suggestion. 

Current configuration : 6715 bytes
!
! Last configuration change at 09:16:50 IST Fri Nov 2 2018
! NVRAM config last updated at 15:08:12 IST Wed Oct 31 2018
! NVRAM config last updated at 15:08:12 IST Wed Oct 31 2018
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname MUMBAI-NSE
!
boot-start-marker
boot system flash c2900-universalk9-mz.SPA.152-1.T4.bin
boot-end-marker
!
!
no logging on
!
no aaa new-model
clock timezone IST 5 30
!
no ipv6 cef
!
!
!
ip multicast-routing
!
!
ip flow-cache timeout active 1
ip cef
multilink bundle-name authenticated
!
no mpls ip
!
crypto pki token default removal timeout 0
!
!
license udi pid CISCO2911/K9 sn FGL151912YC
license boot module c2900 technology-package datak9
!
!
!
redundancy
!
!
ip ftp username itsdc
ip ftp password jhjytg
!
class-map match-all SQOS
 match access-group name sgx
class-map match-all qos2
 match access-group name file
class-map match-all other
 match access-group 121
class-map match-all qos
 match access-group 120
!
!
policy-map FILE
 class qos2
  bandwidth 800
policy-map BQOS
 class qos
  bandwidth 40000
  queue-limit 1000 packets
 class other
  bandwidth 5000
  queue-limit 10 packets
policy-map SQOS
 class SQOS
  priority level 1
 class other
  priority level 2
policy-map SGX
!
!
!
!
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 description NSE-BSE
 ip address 172.16.18.2 255.255.255.252
 ip pim sparse-dense-mode
 ip flow ingress
 ip flow egress
 ip ospf dead-interval minimal hello-multiplier 3
 load-interval 30
 duplex auto
 speed 100
 service-policy output BQOS
!
interface GigabitEthernet0/1
 description NSE-GGN
 ip address 10.95.253.81 255.255.255.252
 ip pim sparse-dense-mode
 ip flow ingress
 ip flow egress
 ip ospf dead-interval minimal hello-multiplier 3
 load-interval 30
 duplex full
 speed auto
 service-policy output BQOS
!
interface GigabitEthernet0/2
 description LOCAL-LAN
 ip address 172.25.40.100 255.255.0.0
 ip access-group 101 in
 ip accounting output-packets
 ip pim sparse-dense-mode
 ip flow ingress
 ip flow egress
 ip virtual-reassembly in
 ip route-cache same-interface
 ip route-cache policy
 duplex auto
 speed auto
!
interface FastEthernet0/0/0
 description NSE-DGCX
 ip address 172.16.26.1 255.255.255.0
 ip access-group 130 in
 ip pim sparse-dense-mode
 ip flow ingress
 ip flow egress
 ip ospf dead-interval minimal hello-multiplier 3
 load-interval 30
 duplex auto
 speed auto
 service-policy output SQOS
!
interface FastEthernet0/1/0
 description NSE-MCX
 ip address 172.16.20.1 255.255.255.0
 ip ospf dead-interval minimal hello-multiplier 3
 duplex auto
 speed auto
!
interface FastEthernet0/1/1
 description NSE-SGX
 ip address 172.16.27.1 255.255.255.0
 ip ospf dead-interval minimal hello-multiplier 3
 duplex auto
 speed auto
!
interface FastEthernet0/2/0
 description NSE-CME
 ip address xx.xx.75.xx 255.255.255.248
 duplex auto
 speed auto
!
interface FastEthernet0/2/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
!
router ospf 2
 network 10.95.253.81 0.0.0.0 area 0
 network 172.16.18.0 0.0.0.3 area 0
 network 172.16.20.0 0.0.0.3 area 0
 network 172.16.20.0 0.0.0.255 area 0
 network 172.16.23.0 0.0.0.3 area 0
 network 172.16.26.0 0.0.0.255 area 0
 network 172.16.27.0 0.0.0.255 area 0
 network 172.25.0.0 0.0.255.255 area 0
 network 192.168.16.0 0.0.0.255 area 0
 network 192.168.150.0 0.0.0.255 area 0
 maximum-paths 2
!
ip forward-protocol nd
!
ip pim rp-address 10.95.25.82
ip pim autorp listener
no ip http server
no ip http secure-server
ip flow-export source GigabitEthernet0/1
ip flow-export version 9
ip flow-export template timeout-rate 1
ip flow-export destination 191.191.191.52 9996
ip flow-top-talkers
 top 40
 sort-by bytes
 cache-timeout 20000
!
ip route xx.xx.7.0 255.255.255.252 172.16.2.2
ip route xx.xx.7.0 255.255.255.248 1.29.7.11
ip route 10.29.7.0 255.255.255.0 1.29.7.11
ip route 192.168.1.10 255.255.255.255 10.95.25.82
ip route 192.168.1.0 255.255.255.0 192.168.1.1
ip route 192.168.1.0 255.255.255.0 192.168.1.1
ip route 192.168.6.0 255.255.255.0 10.95.25.82
!
ip access-list extended file
 permit tcp any any eq 445
ip access-list extended other
 deny   udp any any eq 45000
 deny   udp any any eq 45002
 deny   udp any any eq 45003
 permit ip any any
ip access-list extended sgx
 permit udp any any eq 45000
 permit udp any any eq 45002
 permit udp any any eq 45003
 permit tcp any any eq 1801
!
no logging trap
access-list 101 deny   udp any any eq 9999
access-list 101 deny   udp any any eq 34074
access-list 101 deny   udp any any eq 34330
access-list 101 deny   udp any any eq 34586
access-list 101 deny   udp any any eq 5450
access-list 101 deny   udp any any eq 5440
access-list 101 deny   udp any any eq 45446 log
access-list 101 deny   udp any any eq 80 log
access-list 101 deny   udp any any eq 17742 log
access-list 101 deny   udp any any eq 50554 log
access-list 101 deny   udp any any eq 56955 log
access-list 101 permit ip any any
access-list 110 deny   tcp any any eq 3389
access-list 110 deny   tcp any any eq 445
access-list 110 permit ip any any
access-list 120 deny   ip host 172.25.45.21 any
access-list 120 deny   ip host 172.25.45.52 any
access-list 120 deny   ip host 172.25.45.18 any
access-list 120 deny   ip host 172.25.45.18 any
access-list 120 permit ip any any
access-list 120 deny   tcp any any log
access-list 120 deny   udp any any log
access-list 120 deny   ip host 172.25.45.3 any
access-list 121 deny   udp any any eq 45000
access-list 121 deny   udp any any eq 45002
access-list 121 deny   udp any any eq 45003
access-list 121 permit ip any any
access-list 121 permit ip host 172.25.45.5 any
access-list 121 permit ip host 172.25.45.21 any
access-list 121 permit ip host 172.25.45.18 any
access-list 121 permit ip host 172.25.45.18 any
access-list 121 permit udp any any
access-list 121 permit udp any any eq 45000
access-list 121 permit udp any any eq 45002
access-list 121 permit udp any any eq 45003
access-list 121 deny   udp any any log
access-list 121 deny   ip host 172.25.45.8 any
access-list 130 deny   udp any any eq 9999
access-list 130 deny   udp any any eq 34463
access-list 130 permit ip any any
access-list dynamic-extended
!
!
!
!
!
snmp-server community public RW
snmp-server ifindex persist
!
control-plane
!
!
!
line con 0
line aux 0
line 2
 no activation-character
 no exec
 transport preferred none
 transport input all
 transport output lat pad telnet rlogin lapb-ta mop udptn v120 ssh
 stopbits 1
line vty 0 4
 login
 transport input all
line vty 5 10
 login
 transport input all
!
scheduler allocate 20000 1000
end
Improve this question
7
  • 5
    You'll need to analyze the incoming traffic (e.g. packet capture) to locate the source. Then you can either shut it up or filter it. "Unwanted" traffic shouldn't be allowed in the first place, you permit "wanted" traffic and deny everything else.
    – Zac67 ♦
    Commented Nov 2, 2018 at 10:47
  • 1
    To help us out, please include the output from "show process cpu | e 0.00" and "show logging buffered" That will give us a hint to what's causing the problem. I suspect multicast, since it's unlikely UDP would cause the CPU to spike.
    – Ron Trunk
    Commented Nov 2, 2018 at 14:27
  • Is it possible that you are receiving multicast on the interfaces that are NOT configured with PIM?
    – Ron Trunk
    Commented Nov 2, 2018 at 14:28
  • 3
    It looks more like you are having OSPF convergence problems. Messing with things like ip ospf dead-interval minimal hello-multiplier will absolutely drive the CPU utilization up, and it can cause OSPF to bounce through the entire area.
    – Ron Maupin ♦
    Commented Nov 2, 2018 at 14:39
  • For ip flow choose either ingres OR egres. And as Ron Maupin already mentioned the ip ospf dead-interval will cause high CPU as well. If you need fast convergence then use BFD instead.
    – user54905
    Commented Apr 5, 2019 at 20:02

2 Answers 2

Reset to default
2

Without looking at the packet-capture, network architecture etc. etc. it is a very hard question to answer. You can't really make a policy or anything that would drop frames (since they are routing at Layer 2 in the OSI model). However there are some things that could be going on:

  1. Broadcast storm - There could be a switch that is uplinking to another switch that does not have STP enabled. This switch loop can cause broadcast packets to be re-transmitted down paths that have already seen the message.

  2. LAN re-architecture (most probable) - This is a heavy stream oriented business. Having 4 /24s and a a /16 on the same router that interfaces with critical systems as an ISR (access router) is ill advised. I would recommend going with a more suited core router or a campus network design. This is the equivalent of getting a Honda Civic and wondering why you're loosing in a race with a Ferari. You are using an ISR router for something it isn't meant to do.

Improve this answer
0

I am not going to be technical but what I know from the field is stock exchange information is delivered via UDP Multicast(I had 3 broker customers). Imagine all that stock information is pushed and updated every second. That is how that huge amount of data keeps flowing from the market to your customer (and everybody interested). These networks are not like connecting to the internet, there should be a specific configuration template that should be applied. Consult the service provider (not to ISP but the broker network administrators, there is always a huge team to handle directly connected customers) and share the configuration. They may advise you in terms of configuration or hardware upgrade.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.