Packetshaper CPU is constant under stress

Products

• PacketShaper

Issue/Introduction

When Packeshaper's hardware limit is approaching, it will usually reflected on constant low CPU resource.  Hardware limit could be influenced by the characteristic of the network traffic and the configuration of Packetshaper.  There are couple ways to reduce the load and they are descirbed as following.

1.  Trim the class tree. 

2.  Disable any function that's not needed.  eg,. Adaptive response, top user analysis...

3.  If Adaptive Response is configured, avoid monitor interval set at short interval (1 min).

4.  Use dynamic partition only if necessary.

5.  In case of virus or worm attack.  Run the "host info -sp < ip address> -n 50" to identify top 50 hosts with most number of failed flows. eg, syn flood.  Remove the hosts after been identified.

6.  Run the command "net nic" to identify if there is a possible broadcast storm.  This can be determined by looking at the TxNonUnicast and RxNonUnicast counters.

7.  If the CPU load is caused by excessive flows and assume they are all legitamate, there is function in Packetshaper call "load shedding" which sets the limit of flows that each IP can forward through Packetshaper.  The command to run is "set loadshedding".  Different parameters can be set to fit your network requirement.

8.  By default default Packetshaper runs internal diagnostic file every 15 minutes.  Make sure system value diagshort is set to 1.  This will avoid stress load add to CPU when diagnostic file is been generated.

9.  Avoid excessive data polling from external host to Packetshaper.  This include SNMP,XML or any automated scripts

All the command mentioned above can be found in the CLI referance in Packetguide.  Please contact support if you have any additional questions.