- BGP CPU Exploit

PDA

View Full Version : BGP CPU Exploit


Gary
07-25-2004, 02:48 AM
Every so often the CPU on one or more of our 3660's goes to 75% when the
network is basically idle.

Most of the time CPU sits as 20% MAX.

When I check show proc cpu the only item high is
93 4151308 31498758 131 54.62% 51.56% 52.37% 0 BGP I/O
94 4469448 26517 168556 0.00% 5.46% 4.44% 0 BGP Scanner

Now All BGP sessions are up and happy and the logs indicate no problems at
all.

A simple reboot clears the CPU and puts it back to normal levels. Seems like
something is triggering this - We are running c3660-is-mz.122-1.bin and see
this on at least 2 border 3660's but not the 7500's

Is this some attempted exploit - Cisco has nothing on it ....

Thanks
Gary

Gary
07-25-2004, 02:48 AM
"Gary" <reachus@netlink.info> wrote in message
news:16IKc.4265$fB4.3603@lakeread01...
> Every so often the CPU on one or more of our 3660's goes to 75% when the
> network is basically idle.
>
> Most of the time CPU sits as 20% MAX.
>
> When I check show proc cpu the only item high is
> 93 4151308 31498758 131 54.62% 51.56% 52.37% 0 BGP I/O
> 94 4469448 26517 168556 0.00% 5.46% 4.44% 0 BGP Scanner
>
> Now All BGP sessions are up and happy and the logs indicate no problems at
> all.
>
> A simple reboot clears the CPU and puts it back to normal levels. Seems
like
> something is triggering this - We are running c3660-is-mz.122-1.bin and
see
> this on at least 2 border 3660's but not the 7500's
>
> Is this some attempted exploit - Cisco has nothing on it ....
>
> Thanks
> Gary
>
>

Just checked logs again and about the time CPU went high we see this in the
logs - Not sure if it is relevant

Jul 19 03:27:09 core.net.uk 18660:
Jul 19 03:27:09 core.net.uk 18661: ^U
Jul 19 03:27:09 core.net.uk 18662: ^Z}5LCru?P^X<)*:
Jul 19 03:27:10 core.net.uk 18663: Jul 19 03:27:47 BST: %SYS-2-BADSHARE: Bad
refcount in datagram_done, ptr=61E8AB9C, count=0
Jul 19 03:27:10 core.net.uk 18664: -Traceback= 603D1EFC 604BB034 606B65E8
606B70D0 6040ECF4 6040ECE0

G

Pavlov
07-25-2004, 02:48 AM
>> something is triggering this - We are running c3660-is-mz.122-1.bin and

Gary,

122-1 is pretty long in the tooth and I would recommend something a bit
newer. It may be a memory leak that's inadvertently causing your CPU
pegging. 122-19c might be a good place to start.

- Pavlov

Check out my pics!
http://www.neiu.edu/~akkoziol