High CPU caused by Multicast on 6500

Question

Hello  - could anyone please assist?
I'm see constant(often daily) alerts that indicate high CPU on one of our Cisco Cat 6500 core switches.
The PIDs refered to are:
276 - IP Input
560 - PIM Process 
Combined, these 2 processes take the CPU over 85%, most often hitting 99%.
The core switch is also the Rendevous Point for the LAN.
Many thanks
Lee  

Answer 1

Hi Lee,
You say this is a core router, but as people use this terms to mean different things, are there any directly connected hosts? If there are one thing to check for is hosts sending multicast traffic with TTL=1. If you run the command show ip traffic | in bad hop and look at the rate the "bad hop count" is increasing. If I had a £ for every time I've seen that problem.... I couldn't retire just yet, but at least I could go buy myself a beer or two.
If you're seeing the hop count increasing at a rapid rate there are a couple of options:
Take a read of Troubleshooting high CPU on a 6500 with sup720 starting from the section Tools used to determine the source of the traffic and identify the hosts sending multicast with TTL=1.
If the Catalyst 6500 use PFC 3B add the command mls rate-limit all ttl-failure 100 10 to drop the multicast traffic in hardware.
The first option will take you longer, but at least you identify the cause and can advise the application owner why they should change their applications behaviour.
Regards