1. Troubleshooting High CPU due to Multicast
Cisco Support Community Presents Tech-Talk Series
Troubleshooting High CPU due to Multicast
With,
Ruchir Jain
Customer Support Engineer
CCIE R&S (26911)

2. Agenda What could possibly cause multicast to be S/W switched
Troubleshooting approach
Tools that help
Questions from the Cisco Support Community

3. Possible S/W switched flows
Hardware Switching (CEF) is disabled
Presence of “ip igmp join”
Traffic failing RPF
Traffic on first hop router for registration with RP
Any traffic in reserved range X, and
Traffic having TTL=1
Traffic requiring fragmentation
Platform specific limitations

4. Troubleshooting approach?
First step is to determine what is causing the high CPU
CPU sniffer captures
6500/7600: Netdr capture
4500: Inbuilt CPU packet dump capability
3560/3750/ME3XXX: Inbuilt CPU packet dump utility

5. Troubleshooting approach
Determine which groups are causing the problem S ,
Analyze captures and see which groups are processed in software.
If one group has majority of traffic then select that group for further troubleshooting.
If multiple groups are cause of problem then select one with your best judgment. G

6. Troubleshooting approach
Check data part of multicast traffic
See if TTL value is 1
Check the length of packet and compare it to MTU of interfaces
Check if the multicast traffic is from reserved range of group addresses x
Auto-RP flows : and
Check for any IP options present in traffic

7. Troubleshooting approach#
Check mroute entry (show ip mroute <group>)
Router#sh ip mroute
<snip>
(*, ), 00:02:29/stopped, RP , flags: SPF
Incoming interface: Ethernet1/0, RPF nbr
Outgoing interface list: null
( , ), 00:01:34/00:03:26, flags: FT
Incoming interface: Ethernet0/0, RPF nbr
Outgoing interface list:
Ethernet1/0, Forward/Sparse, 00:01:34/00:02:56
Check which PIM flavor are you running
Check if inbound and outbound interfaces are listed properly.
Check if “ip igmp join-group” is present on any interfaces.
If you see “registering” then some problem with registration process

8. Troubleshooting approach#
Check mroute count (show ip mroute <group>)
Router#sh ip mroute count
<snip>
Group: , Source count: 1, Group pkt count: 1869
RP-tree: Forwarding: 0/0/0/0, Other: 2/1/1
Source: /32, Forwarding: 1869/31/996/248, Other: 1871/0/2
Check if RPF is failing
Use “show ip rpf <source_ip>” to figure out the rpf interface
Check if route to source is learned correctly and is present in routing table

9. Troubleshooting approach
Commands that help in troubleshooting process
Debugs: “debug ip pim <group_address>” “debug ip igmp <group_address>”
Show commands: “show ip pim rp mapping” “show ip pim rpf” “show ip pim neighbors”
7xE23A9

10. Troubleshooting approach!
Other things that we can check:
For layer 3 switches if running multicast using SVI then if IGMP snooping is disabled for a VLAN then traffic would be punted to CPU
Platform specific limitations: these can be found on configuration guide of each platform
Incorrect programing of forwarding information in hardware. This is specific to H/W switching platforms.

11. Q & A 11