Troubleshooting High CPU due to Multicast Cisco Support Community Presents Tech-Talk Series Troubleshooting High CPU due to Multicast With, Ruchir Jain Customer Support Engineer CCIE R&S (26911)

Agenda What could possibly cause multicast to be S/W switched Troubleshooting approach Tools that help Questions from the Cisco Support Community

Possible S/W switched flows Hardware Switching (CEF) is disabled Presence of “ip igmp join” Traffic failing RPF Traffic on first hop router for registration with RP Any traffic in reserved range 224.0.0.X, 224.0.1.39 and 224.0.1.40. Traffic having TTL=1 Traffic requiring fragmentation Platform specific limitations

Troubleshooting approach ? First step is to determine what is causing the high CPU CPU sniffer captures 6500/7600: Netdr capture 4500: Inbuilt CPU packet dump capability 3560/3750/ME3XXX: Inbuilt CPU packet dump utility

Troubleshooting approach Determine which groups are causing the problem S , Analyze captures and see which groups are processed in software. If one group has majority of traffic then select that group for further troubleshooting. If multiple groups are cause of problem then select one with your best judgment. G

Troubleshooting approach Check data part of multicast traffic See if TTL value is 1 Check the length of packet and compare it to MTU of interfaces Check if the multicast traffic is from reserved range of group addresses - 224.0.0.x Auto-RP flows : 224.0.1.39 and 224.0.1.40 Check for any IP options present in traffic 01011101

Troubleshooting approach # Check mroute entry (show ip mroute <group>) Router#sh ip mroute 239.1.1.1 <snip> (*, 239.1.1.1), 00:02:29/stopped, RP 4.4.4.4, flags: SPF Incoming interface: Ethernet1/0, RPF nbr 10.1.24.4 Outgoing interface list: null (10.1.12.1, 239.1.1.1), 00:01:34/00:03:26, flags: FT Incoming interface: Ethernet0/0, RPF nbr 0.0.0.0 Outgoing interface list: Ethernet1/0, Forward/Sparse, 00:01:34/00:02:56 Check which PIM flavor are you running Check if inbound and outbound interfaces are listed properly. Check if “ip igmp join-group” is present on any interfaces. If you see “registering” then some problem with registration process

Troubleshooting approach # Check mroute count (show ip mroute <group>) Router#sh ip mroute 239.1.1.1 count <snip> Group: 239.1.1.1, Source count: 1, Group pkt count: 1869 RP-tree: Forwarding: 0/0/0/0, Other: 2/1/1 Source: 10.1.12.1/32, Forwarding: 1869/31/996/248, Other: 1871/0/2 Check if RPF is failing Use “show ip rpf <source_ip>” to figure out the rpf interface Check if route to source is learned correctly and is present in routing table

Troubleshooting approach Commands that help in troubleshooting process Debugs: “debug ip pim <group_address>” “debug ip igmp <group_address>” Show commands: “show ip pim rp mapping” “show ip pim rpf” “show ip pim neighbors” 7xE23A9

Troubleshooting approach ! Other things that we can check: For layer 3 switches if running multicast using SVI then if IGMP snooping is disabled for a VLAN then traffic would be punted to CPU Platform specific limitations: these can be found on configuration guide of each platform Incorrect programing of forwarding information in hardware. This is specific to H/W switching platforms.

Q & A 11