CISCO4503 CPU 使用率达到99% 有FLAPPING 现象 怎么解决？

[tyuthaoban]

c4503-2#show proces cpu | ex 0.00
CPU utilization for five seconds: 99%/1%; one minute: 99%; five minutes: 99%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
25 4876884 215844530 22 0.07% 0.02% 0.02% 0 Net Background
30 24749977561001443617 2471 20.39% 18.17% 18.29% 0 Cat4k Mgmt HiPri
31 37285767283778846581 986 76.07% 78.67% 78.69% 0 Cat4k Mgmt LoPri
63 184 270 681 0.47% 0.12% 0.03% 1 Virtual Exec
67 11301228 71343695 158 0.07% 0.04% 0.05% 0 CEF: IPv4 proces

Cat4k Mgmt 对CPU使用最多

而且

sh logg 有下面的现象
Log Buffer (4096 bytes):
0 in vlan 2 is flapping between port Gi2/1 and port Gi2/12
*Jan 22 02:17:49: %C4K_EBM-4-HOSTFLAPPING: Host 00:11:25:39:7C:4E in vlan 2 is f
lapping between port Gi2/7 and port Gi2/1
*Jan 22 02:17:49: %C4K_EBM-4-HOSTFLAPPING: Host 00:11:25:39:C2:1A in vlan 2 is f
lapping between port Gi2/1 and port Gi2/5
*Jan 22 02:17:49: %C4K_EBM-4-HOSTFLAPPING: Host 00:11:25:39:BF:30 in vlan 2 is f
lapping between port Gi2/10 and port Gi2/1
*Jan 22 02:18:04: %C4K_EBM-4-HOSTFLAPPING: Host 00:11:25:39:7C:4E in vlan 2 is f
lapping between port Gi2/1 and port Gi2/7
*Jan 22 02:18:04: %C4K_EBM-4-HOSTFLAPPING: Host 00:11:25:39:C2:1A in vlan 2 is f
lapping between port Gi2/1 and port Gi2/5
*Jan 22 02:18:04: %C4K_EBM-4-HOSTFLAPPING: Host 00:11:25:39:BF:30 in vlan 2 is f
lapping between port Gi2/1 and port Gi2/10
*Jan 22 02:18:19: %C4K_EBM-4-HOSTFLAPPING: Host 00:11:25:39:C2:1A in vlan 2 is f
lapping between port Gi2/5 and port Gi2/1
*Jan 22 02:18:19: %C4K_EBM-4-HOSTFLAPPING: Host 00:11:25:39:7C:4E in vlan 2 is f
lapping between port Gi2/1 and port Gi2/7
*Jan 22 02:18:19: %C4K_EBM-4-HOSTFLAPPING: Host 00:11:25:39:BF:30 in vlan 2 is f
lapping between port Gi2/1 and port Gi2/10
*Jan 22 02:18:30: %C4K_EBM-4-HOSTFLAPPING: Host 00:11:25:39:BF:10 in vlan 2 is f
lapping between port Gi2/1 and port Gi2/12
*Jan 22 02:18:34: %C4K_EBM-4-HOSTFLAPPING: Host 00:11:25:39:C2:1A in vlan 2 is f
lapping between port Gi2/1 and port Gi2/5
*Jan 22 02:18:34: %C4K_EBM-4-HOSTFLAPPING: Host 00:11:25:39:7C:4E in vlan 2 is f
lapping between port Gi2/7 and port Gi2/1
*Jan 22 02:18:34: %C4K_EBM-4-HOSTFLAPPING: Host 00:11:25:39:BF:30 in vlan 2 is f
lapping between port Gi2/10 and port Gi2/1
*Jan 22 02:18:49: %C4K_EBM-4-HOSTFLAPPING: Host 00:11:25:39:C2:1A in vlan 2 is f
lapping between port Gi2/5 and port Gi2/1
*Jan 22 02:18:49: %C4K_EBM-4-HOSTFLAPPING: Host 00:11:25:39:7C:4E in vlan 2 is f
lapping between port Gi2/1 and port Gi2/7
*Jan 22 02:18:49: %C4K_EBM-4-HOSTFLAPPING: Host 00:11:25:39:BF:30 in vlan 2 is f
lapping between port Gi2/1 and port Gi2/10


都是在Gi2/1和其他端口之间flapping

[一半乐事]

当你的交换机从A端口学习到一个新的MAC地址，而该MAC地址在B端口地CAM（content-addressable memory）里已经存在。这时，就会出现两个端口间的flapping。当多个MAC出现这种现象时，表示网络有异常。此时网络上的MAC地址快速地从一个端口变到另一个端口。
一般有以下可能：
1.某设备的多个端口用同一个MAC地址（非法修改）。
2.HSRP问题。
3.EtherChannel配置有误。
从你的情况看，应该是Gi2/1下面有什么问题，有可能是病毒或是有人恶意破坏。

[逍遥过客]

网络中可能有环路，产生广播风暴了，查查端口下的收报统计，广播报文是不是很多？

[junrenwxd]

[Quote=引用 2 楼 mingming_lu 的回复:]
网络中可能有环路，产生广播风暴了，查查端口下的收报统计，广播报文是不是很多？
[/Quote]
是怎么查的
是sh int/
是sh 接口么！！！

[beyondtc]

不出意外，应该是环路问题，从你表述来说，G2/1和G2/10之间，G2/1和G2/7之间，G2/1和G2/5之间出现mac地址冲突问题。

但这只是现象，应该是有比较明显的环路，建议你show spanning-tree interface，show vlan brife或者show mac-address-table等命令来查看一下二层信息。

当然先手工查看一下连线肯定是必要的。

从CPU占用率达到99%来说，应该是环路，ARP病毒不太容易导致99%的占用率。

个人拙见，希望对你有帮助！

[初学者]

可能是有ARP或蠕虫病毒导致，也有可能是环路导致，看一下sh int G2/1的结果，shutdown G2/1口应该可以恢复正常。sh spantree vlan 2看一下。