Reset Search



OSPF Neighborship Flapping

« Go Back


TitleOSPF Neighborship Flapping
  1. OSPF neighbors flapping on point to point links
  2. No port congestion seen
  3. CPU congestion seen via debug hal show congestion
  4. tbcm_msm_tx0 process utilizes 50-60% CPU briefly then returns to normal
  5. Hello packets being missed
  6. Up Timer on one ospf neighbor shows no loss of neighbor.  Other neighbor shows up timer starting back at 0 counter
All EXOS Platforms
Switch CPU is sending a large amount of ARP requests for all IPs in a subnet range causing high tbcm_msm_tx cpu utilization 
  1. Type <TOP>
  2. Confirm tbcm_msm_tx process is showing high cpu utilization
  3. Type <debug hal show congestion>
  4. Type <enable debug-mode>  (input password from challenge)
  5. Type <!tcpdump -i Broadcom -c 3000 -w /scratch/internal/<filename>.pcap>
  6. Confirm ARP request flood
  7. Type rtlookup <ARP target IP>
  8. Mirror traffic on port from step 7 to find source that is sending ICMP requests
Please contact GTAC for debug password. The password is valid for only 60 minutes.
Additional notes
IP scanners will send ICMP requests to all IPs in a subnet (depending on configuration).  When this security device is on a different subnet from the range it is scanning, routing must occur at the switch level.  Since arp entry may not exist in network, the switch must send arp request to find target.  Depending on how many ports  are added to a vlan, the switch by design will send an arp request for every port in that vlan (broadcast).  This creates a lot of traffic from CPU and can cause instability in protocols if CPU is busy.



Was this article helpful?



Please tell us how we can make this article more useful.

Characters Remaining: 255