Catalyst 9000交換器上控制平面作業疑難排解
下載選項
已更新: 2024 年 4 月 3 日
文件 ID:221841
無偏見用語
本產品的文件集力求使用無偏見用語。針對本文件集的目的，無偏見係定義為未根據年齡、身心障礙、性別、種族身分、民族身分、性別傾向、社會經濟地位及交織性表示歧視的用語。由於本產品軟體使用者介面中硬式編碼的語言、根據 RFP 文件使用的語言，或引用第三方產品的語言，因此本文件中可能會出現例外狀況。深入瞭解思科如何使用包容性用語。
關於此翻譯
思科已使用電腦和人工技術翻譯本文件，讓全世界的使用者能夠以自己的語言理解支援內容。請注意，即使是最佳機器翻譯，也不如專業譯者翻譯的內容準確。Cisco Systems, Inc. 對這些翻譯的準確度概不負責，並建議一律查看原始英文文件（提供連結）。
簡介
本文說明如何對執行Cisco IOS® XE的Catalyst 9000系列交換器上的控制平面健康狀況進行疑難排解和驗證。
背景資訊
交換器的主要工作是儘快轉送封包。大多數資料包在硬體中轉發，但某些型別的流量必須由系統CPU處理。儘快處理到達CPU的流量。預計在CPU中會看到一定數量的流量，但是過多的流量會導致操作問題。Catalyst 9000系列交換器預設情況下納入穩健的控制平面管制(CoPP)機制，以防止CPU流量過度飽和所導致的問題。
在某些使用情形中，作為正常操作的函式，會出現意想不到的問題。因果關係有時不明顯，使問題難以處理。本文檔提供了用於驗證控制平面運行狀況的工具，並提供了有關如何處理涉及控制平面點焊或注射路徑問題的工作流。它還根據現場出現的問題提供了幾種常見的情形。
請記住，CPU分支路徑是有限的資源。現代硬體轉發交換機可以處理呈指數級增長的流量。Catalyst 9000系列交換機在任何給定時間的CPU上支援約19,000個每秒資料包數(pps)。超過此閾值，將無權重地管制傳入的流量。
技術
- 轉發引擎驅動程式(FED):這是Cisco Catalyst交換機的核心，負責所有硬體程式設計/轉發
- IOSd:這是在Linux核心上運行的Cisco IOS守護程式。它在核心中作為軟體進程運行
- 封包交付系統(PDS):這是將資料包傳輸到各個子系統和從各個子系統傳輸資料包的體系結構和過程。例如，它控制資料包如何從FED傳送到IOSd，反之亦然
- 控制平面(CP):控制平面是一個通用術語，用於將涉及Catalyst交換機CPU的功能和流量組合在一起。其中包括目的地為交換器或來自交換器的流量，例如跨距樹狀目錄通訊協定(STP)、熱待命路由器通訊協定(HSRP)和路由通訊協定。這也包括必須由CPU處理的應用層協定，如安全外殼(SSH)和簡單網路管理協定(SNMP)
- 資料平面(DP)：通常資料平面包含硬體ASIC和流量，這些流量無需控制平面的幫助即可轉發
- Punt：在DP上截獲的入口協定控制資料包傳送到CP進行處理
- 注入：CP生成的協定資料包傳送到DP以在IO介面上輸出
- LSMPI:Linux共用記憶體點介面
Catalyst 9000 CoPP
Catalyst 9000系列交換機上的CPU保護基礎是CoPP。 使用CoPP時，系統生成的服務品質(QoS)策略應用於CPU點入/插入路徑。CPU繫結的流量被分為許多不同的類，隨後對映到與CPU關聯的各個硬體策略器。監察器可防止特定流量類別導致CPU過飽和。
CoPP實施
CPU繫結的流量被分類到隊列中。這些隊列/類是系統定義的，不可由使用者配置。策略器在硬體中配置。Catalyst 9000系列支援32個隊列的32個硬體策略器。
具體值因平台而異。一般來說，有32個系統定義的隊列。這些隊列與類對映相關，類對映與監察器索引相關。策略器索引具有預設策略器速率。此速率可由使用者配置，但對預設CoPP策略的更改會增加意外服務影響的敏感性。
|
類對映名稱 |
管制器索引（管制器編號） |
CPU隊列（隊列號） |
|---|---|---|
| system-cpp-police-data |
WK_CPP_POLICE_DATA(0) |
WK_CPU_Q_ICMP_GEN(3) WK_CPU_Q_BROADCAST(12) WK_CPU_Q_ICMP_REDIRECT(6) |
| system-cpp-police-l2-control |
WK_CPP_POLICE_L2_控制(1) |
WK_CPU_Q_L2_CONTROL(1) |
| system-cpp-police-routing-control |
WK_CPP_POLICE_ROUTING_CONTROL(2) |
WK_CPU_Q_ROUTING_CONTROL(4) WK_CPU_Q_LOW_LATENCY(27) |
| system-cpp-police-control-low-priority |
WK_CPP_POLICE_CO控制_LOW_PRI(3) |
WK_CPU_Q_GENERAL_PUNT(25) |
| system-cpp-police-punt-webauth |
WK_CPP_POLICE_PU NT_WEBAUTH(7) |
WK_CPU_Q_PUNT_WEBAUTH(22) |
| system-cpp-police-topology-control |
WK_CPP_POLICE_TOPOLOGY_CONTROL(8) |
WK_CPU_Q_TOPOLOGY_CONTROL(15) |
| system-cpp-police-multicast |
WK_CPP_POLICE_MULTICAST(9) |
WK_CPU_Q_TRANSIT_TRAFFIC(18) WK_CPU_Q_MCAST_DATA(30) |
| system-cpp-police-sys-data |
WK_CPP_POLICE_SYS_DATA(10) |
WK_CPU_Q_LEARNING_CACHE_OVFL(13) WK_CPU_Q_CRYPTO_CONTROL(23) WK_CPU_Q_EXCEPTION(24) WK_CPU_Q_EGR_EXCEPTION(28) WK_CPU_Q_NFL_SAMPLED_DATA(26) WK_CPU_Q_GOLD_PKT(31) WK_CPU_Q_RPF_FAILED(19) |
| system-cpp-police-dot1x-auth |
WK_CPP_POLICE_DOT1X(11) |
WK_CPU_Q_DOT1X_AUTH(0) |
| system-cpp-police-protocol-snooping |
WK_CPP_POLICE_PR(12) |
WK_CPU_Q_PROTO_SNOOPING(16) |
| system-cpp-police-sw-forward |
WK_CPP_POLICE_SW_FWD(13) |
WK_CPU_Q_SW_FORWARDING_Q(14) WK_CPU_Q_LOGGING(21) WK_CPU_Q_L2_LVX_DATA_PACK(11) |
| system-cpp-police-forus |
WK_CPP_POLICE_FORUS(14) |
WK_CPU_Q_FORUS_ADDR_RESOLUTION(5) WK_CPU_Q_FORUS_TRAFFIC(2) |
| system-cpp-police-multicast-end-station |
WK_CPP_POLICE_MULTICAST_SNOOPING(15) |
WK_CPU_Q_MCAST_END_STA SERVICE(20) |
| system-cpp-default |
WK_CPP_POLICE_DEFAULT_POLICER(16) |
WK_CPU_Q_DHCP_SNOOPING(17) WK_CPU_Q_UNUSED(7) WK_CPU_Q_EWLC_CONTROL(9) WK_CPU_Q_EWLC_DATA(10) |
| system-cpp-police-stackwise-virt-control |
WK_CPP_STACKWISE_VIRTUAL_CONTROL(5) |
WK_CPU_Q_STACKWISE_VIRTUAL_CONTROL(29) |
|
system-cpp-police-l2lvx-control |
WK_CPP_ L2_LVX_CONT_PACK(4) |
WK_CPU_Q_L2_LVX_CONT_PACK(8) |
每個隊列與流量型別或特定功能集相關。這不是一份詳盡的清單：
|
CPU隊列（隊列號） |
功能 |
|---|---|
|
WK_CPU_Q_DOT1X_AUTH(0) |
IEEE 802.1x連線埠型驗證 |
|
WK_CPU_Q_L2_CONTROL(1) |
動態Trunk通訊協定(DTP) VLAN主幹通訊協定(VTP) 連線埠彙總通訊協定(PAgP) 使用者端資訊訊號通訊協定(CISP) 消息會話中繼協定 多個VLAN註冊通訊協定(MVRP) 城域行動網路(MMN) 連結層級探索通訊協定(LLDP) 單向連結偵測(UDLD) 連結彙總控制通訊協定(LACP) Cisco Discovery Protocol(CDP) 生成樹通訊協定(STP) |
|
WK_CPU_Q_FORUS_TRAFFIC(2) |
主機，如Telnet、Pingv4和Pingv6以及SNMP Keepalive/環回檢測 Initiate-Internet Key Exchange(IKE)協定(IPSec) |
|
WK_CPU_Q_ICMP_GEN(3) |
ICMP — 目的地無法連線 ICMP-TTL已過期 |
|
WK_CPU_Q_ROUTING_CONTROL(4) |
路由資訊通訊協定第1版(RIPv1) RIPv2 內部閘道路由通訊協定 (IGRP) 邊界閘道通訊協定(BGP) PIM-UDP 虛擬路由器備援通訊協定(VRRP) 熱待命路由器通訊協定第1版(HSRPv1) HSRPv2 閘道負載平衡通訊協定(GLBP) 標籤發佈通訊協定(LDP) 網路快取通訊協定(WCCP) 路由資訊通訊協定下一代(RIPng) 開放最短路徑優先(OSPF) 開放最短路徑優先版本3(OSPFv3) 增強型內部閘道路由通訊協定(EIGRP) 增強型內部閘道路由通訊協定第6版(EIGRPv6) DHCPv6 通訊協定無關多點傳送(PIM) 通訊協定無關多點傳送版本6(PIMv6) 熱待命路由器通訊協定下一代(HSRPng) IPv6控制 通用路由封裝(GRE)存留 網路位址轉譯(NAT)分支 中間系統到中間系統(IS IS) |
|
WK_CPU_Q_FORUS_ADDR_RESOLUTION(5) |
位址解析通訊協定(ARP) IPv6鄰居通告和鄰居請求 |
|
WK_CPU_Q_ICMP_REDIRECT(6) |
網際網路控制訊息通訊協定(ICMP)重新導向 |
|
WK_CPU_Q_INTER_FED_TRAFFIC(7) |
第2層網橋域注入用於內部通訊。 |
|
WK_CPU_Q_L2_LVX_CONT_PACK(8) |
交換ID(XID)資料包 |
|
WK_CPU_Q_EWLC_CONTROL(9) |
嵌入式無線控制器(eWLC)[無線存取點的控制與布建(CAPWAP)(UDP 5246)] |
|
WK_CPU_Q_EWLC_DATA(10) |
eWLC資料包（CAPWAP資料，UDP 5247） |
|
WK_CPU_Q_L2_LVX_DATA_PACK(11) |
對映請求傳出的未知單播資料包。 |
|
WK_CPU_Q_BROADCAST(12) |
所有型別的廣播 |
|
WK_CPU_Q_OPENFLOW(13) |
學習快取溢位（第2層+第3層） |
|
WK_CPU_Q_CONTROLLER_PUNT(14) |
資料 — 存取控制清單(ACL)已滿 資料 — IPv4選項 資料 — IPv6逐跳 資料 — 資源不足/全部捕獲 資料 — 反向路徑轉送(RPF)不完整 收集資料包 |
|
WK_CPU_Q_TOPOLOGY_CONTROL(15) |
生成樹通訊協定(STP) 彈性乙太網路通訊協定(REP) 共用跨距樹狀目錄通訊協定(SSTP) |
|
WK_CPU_Q_PROTO_SNOOPING(16) |
適用於動態ARP檢查(DAI)的地址解析通訊協定(ARP)窺探 |
|
WK_CPU_Q_DHCP_SNOOPING(17) |
DHCP窺探 |
|
WK_CPU_Q_TRANSIT_TRAFFIC(18) |
這用於NAT傳送的資料包，這些資料包需要在軟體路徑中處理。 |
|
WK_CPU_Q_RPF_FAILED(19) |
資料 — mRPF（組播RPF）失敗 |
|
WK_CPU_Q_MCAST_END_STATION_SERVICE(20) |
網際網路群組管理通訊協定(IGMP)/多點傳送監聽器探索(MLD)控制 |
|
WK_CPU_Q_LOGGING(21) |
存取控制清單(ACL)記錄 |
|
WK_CPU_Q_PUNT_WEBAUTH(22) |
Web驗證 |
|
WK_CPU_Q_HIGH_RATE_APP(23) |
廣播 |
|
WK_CPU_Q_EXCEPTION(24) |
IKE指示 IP學習違規 IP連線埠資安違規 IP靜態位址違規 IPv6範圍檢查 遠端複製通訊協定(RCP)例外狀況 單播RPF失敗 |
|
WK_CPU_Q_SYSTEM_CRITICAL(25) |
媒體訊號/無線代理ARP |
|
WK_CPU_Q_NFL_SAMPLED_DATA(26) |
Netflow樣本資料和媒體服務代理(MSP) |
|
WK_CPU_Q_LOW_LATENCY(27) |
雙向轉發檢測(BFD)、精確時間協定(PTP) |
|
WK_CPU_Q_EGR_EXCEPTION(28) |
輸出解析異常 |
|
WK_CPU_Q_STACKWISE_VIRTUAL_CONTROL(29) |
前端堆疊協定，即SVL |
|
WK_CPU_Q_MCAST_DATA(30) |
資料 — (S，G)建立 資料 — 本地聯接 資料 — PIM註冊 資料 — SPT切換 資料 — 多點傳送 |
|
WK_CPU_Q_GOLD_PKT(31) |
金牌 |
預設策略
預設情況下，系統生成的CoPP策略應用於打孔/插入路徑。使用常見的基於MQC的命令可以檢視預設策略。它也可以在交換機配置中檢視。唯一允許應用於CPU/控制平面的輸入或輸出的策略是系統定義的策略。
使用「show policy-map control-plane」檢視應用於控制平面的策略：
Catalyst-9600#show policy-map control-plane
Control Plane
Service-policy input: system-cpp-policy
Class-map: system-cpp-police-ios-routing (match-any)
0 packets, 0 bytes
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: none
police:
rate 17000 pps, burst 4150 packets
conformed 95904305 bytes; actions:
transmit
exceeded 0 bytes; actions:
drop
<snip>
Class-map: class-default (match-any)
0 packets, 0 bytes
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: any
調整CoPP
CoPP管制器速率可由使用者配置。使用者還可以禁用隊列。
此示例演示如何調整單個監察器值。在本例中，調整的類是「system-cpp-police-protocol-snooping」。
Device> enable
Device# configure terminal
Device(config)# policy-map system-cpp-policy
Device(config-pmap)#
Device(config-pmap)# class system-cpp-police-protocol-snooping
Device(config-pmap-c)#
Device(config-pmap-c)# police rate 100 pps
Device(config-pmap-c-police)#
Device(config-pmap-c-police)# exit
Device(config-pmap-c)# exit
Device(config-pmap)# exit
Device(config)#
Device(config)# control-plane
Device(config-cp)#
Device(config)# control-plane
Device(config-cp)#service-policy input system-cpp-policy
Device(config-cp)#
Device(config-cp)# end
Device# show policy-map control-plane
此示例演示如何完全禁用隊列。禁用隊列時請務必小心，因為這樣可能會導致CPU過飽和。
Device> enable
Device# configure terminal
Device(config)# policy-map system-cpp-policy
Device(config-pmap)#
Device(config-pmap)# class system-cpp-police-protocol-snooping
Device(config-pmap-c)#
Device(config-pmap-c)# no police rate 100 pps
Device(config-pmap-c)# end
疑難排解
方法
CPU利用率受兩個基本活動的影響 — 進程和中斷。進程是CPU執行的結構化活動，而中斷是指在資料平面上截獲並傳送到CPU以供操作的資料包。這些活動共同構成了CPU的總利用率。由於預設情況下啟用CoPP，服務影響不一定與CPU使用率高相關。如果CoPP執行它的工作，CPU利用率不會受到很大影響。考慮CPU的總體利用率很重要，但總體利用率並不能反映整個情況。本部分中的show命令和實用程式用於快速評估CPU的運行狀況，並確定有關CPU繫結的流量的相關詳細資訊。
指南：
- 確定問題是否與控制平面相關。大多數傳輸流量在硬體中轉發。只有某些流量型別和某些場景涉及CPU和控制平面，因此在整個調查過程中請記住這一點。
- 瞭解您的利用率基準。瞭解正常利用率情況很重要，這樣就可以確定與標準之間的偏差。
- 驗證進程和中斷的總體利用率。確定佔用意外的CPU週期數量的任何進程。如果利用率超出預期範圍，則可能引起關注。瞭解系統的平均利用率很重要，這樣可以識別標準之外的偏差。請記住，僅使用率並不是控制平面運行狀況的完整圖景。
- 確定CoPP中是否存在主動遞增的丟包。 CoPP丟棄並不一定表示存在問題，但是如果您對與受主動監控的流量類相關的問題進行故障排除，則這是一個重要的關聯性指標。
有用的顯示命令
該交換機可以快速監控CPU運行狀況和CoPP統計資料。還有實用的CLI，可快速確定傳入CPU流量的輸入點。
確定整體和歷史利用率
- 「Show processes cpu sorted」用於檢視總體CPU利用率。「sorted」引數根據使用百分比對進程輸出進行排序。使用更多CPU資源的進程位於輸出的頂端。由於中斷而導致的利用率也以百分比提供。
Catalyst-9600#show processes cpu sorted
CPU utilization for five seconds: 92%/13%; one minute: 76%; five minutes: 73% <<<--- Utilization is displayed for 5 second (both process and interrupt), 1 minute and 5 minute intervals. The value
92% refers to the cumulative percentage of process-driven utilization over the previous 5 seconds.
The 13% value refers to cumulative utilization due to interrupt traffic.
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process <<<--- Runtime statistics, as well as utilization averages are displayed here. The process is also identified by name.
344 547030523 607054509 901 38.13% 30.61% 29.32% 0 SISF Switcher Th
345 394700227 615024099 641 31.18% 22.68% 21.66% 0 SISF Main Thread
98 112308516 119818535 937 4.12% 4.76% 5.09% 0 Crimson flush tr
247 47096761 92250875 510 2.42% 2.21% 2.18% 0 Spanning Tree
123 35303496 679878082 51 1.85% 1.88% 1.84% 0 IOSXE-RP Punt Se
234 955 1758 543 1.61% 0.71% 0.23% 3 SSH Process
547 5360168 5484910 977 1.04% 0.46% 0.44% 0 DHCPD Receive
229 27381066 963726156 28 1.04% 1.34% 1.23% 0 IP Input
79 13183805 108951712 121 0.48% 0.55% 0.55% 0 IOSD ipc task
9 1073134 315186 3404 0.40% 0.06% 0.03% 0 Check heaps
37 11099063 147506419 75 0.40% 0.54% 0.52% 0 ARP Input
312 2986160 240782059 12 0.24% 0.12% 0.14% 0 DAI Packet Proce
<snip>
565 0 1 0 0.00% 0.00% 0.00% 0 LICENSE AGENT
566 14 1210 11 0.00% 0.00% 0.00% 0 DHCPD Timer
567 40 45 888 0.00% 0.00% 0.00% 0 OVLD SPA Backgro
568 12 2342 5 0.00% 0.00% 0.00% 0 DHCPD Database
569 0 12 0 0.00% 0.00% 0.00% 0 SpanTree Flush
571 0 1 0 0.00% 0.00% 0.00% 0 EM Action CNS
572 681 140276 4 0.00% 0.00% 0.00% 0 Inline power inc
- 「Show processes cpu history」提供過去60秒、5分鐘和72小時內CPU使用率的歷史圖形。
Catalyst-9600#show processes cpu history
999777776666688888666667777777777888887777766666999998888866 <<<--- The numbers at the top of each column represent the highest value seen throughout the time period.
222555559999944444444440000088888888881111177777333335555500 It is read top-down. "9" over "2" in this example means "92%" for example.
100
90 *** ***** **********
80 ******** ***** ********** **********
70 ****************** ***********************************
60 **********************************************************
50 **********************************************************
40 **********************************************************
30 **********************************************************
20 **********************************************************
10 ********************************************************** <<<--- The "*" represents the highest value during the given time period. This relates to a momentary spike in utilization.
0....5....1....1....2....2....3....3....4....4....5....5....6 In this example, utilization spiked to 92% in the last 5 seconds.
0 5 0 5 0 5 0 5 0 5 0
CPU% per second (last 60 seconds)
* = maximum CPU% # = average CPU%
999898989999898998998998989889999989889898899999999899999999
431823091102635316235129283771336574892809604014230901133511
100 ** *
90 ***** ****************************************************
80 ************#***#*#**#***####*##*****#**#***#***#*********
70 ########################################################## <<<--- The "#" represents the average utilization. This indicates sustained utilization.
60 ########################################################## In this example, within the last 5 minutes the average utilization was sustained around 70% while
50 ########################################################## the maximum utilization spiked to 94%.
40 ##########################################################
30 ##########################################################
20 ##########################################################
10 ##########################################################
0....5....1....1....2....2....3....3....4....4....5....5....6
0 5 0 5 0 5 0 5 0 5 0
CPU% per minute (last 60 minutes)
* = maximum CPU% # = average CPU%
999999999999999999999999999999999999999999999999999999999999999999999999
665656566646555666655656575654556567737555567574545545775957554648576757
100 ********** ****************** ******* ********* * ** ********* * *****
90 **********************************************************************
80 **********************************************************************
70 ######################################################################
60 ######################################################################
50 ######################################################################
40 ######################################################################
30 ######################################################################
20 ######################################################################
10 ######################################################################
0....5....1....1....2....2....3....3....4....4....5....5....6....6....7..
0 5 0 5 0 5 0 5 0 5 0 5 0
CPU% per hour (last 72 hours)
* = maximum CPU% # = average CPU%
檢查控制階段管制
- 使用「show platform hardware fed <switch> active qos queue stats internal cpu policer」檢視聚合CoPP統計資訊以及有關隊列/策略器結構的其他資訊。此輸出提供自上次重置控制平面以來策略器統計資訊的歷史檢視。這些計數器也可以手動清除。 一般來說，策略器對控制平面丟棄的證據指向相關隊列/類的問題，但確保在出現問題時丟棄會主動增加。多次運行該命令以觀察增加隊列丟棄值的情況。
Catalyst9500#show platform hardware fed active qos queue stats internal cpu policer
CPU Queue Statistics
============================================================================================
(default) (set) Queue Queue
QId PlcIdx Queue Name Enabled Rate Rate Drop(Bytes) Drop(Frames) <-- The top section of this output gives a historical view of CoPP drops. Run the command several times in succession to check for active incrementation.
-------------------------------------------------------------------------------------------- CPU queues correlate with a Policer Index (PlcIdx) and Queue (QId).
0 11 DOT1X Auth Yes 1000 1000 0 0 Note that multiple policer indices map to the same queue for some classes.
1 1 L2 Control Yes 2000 2000 0 0
2 14 Forus traffic Yes 4000 4000 0 0
3 0 ICMP GEN Yes 750 750 0 0
4 2 Routing Control Yes 5500 5500 0 0
5 14 Forus Address resolution Yes 4000 4000 83027876 1297199
6 0 ICMP Redirect Yes 750 750 0 0
7 16 Inter FED Traffic Yes 2000 2000 0 0
8 4 L2 LVX Cont Pack Yes 1000 1000 0 0
9 19 EWLC Control Yes 13000 13000 0 0
10 16 EWLC Data Yes 2000 2000 0 0
11 13 L2 LVX Data Pack Yes 1000 1000 0 0
12 0 BROADCAST Yes 750 750 0 0
13 10 Openflow Yes 250 250 0 0
14 13 Sw forwarding Yes 1000 1000 0 0
15 8 Topology Control Yes 13000 16000 0 0
16 12 Proto Snooping Yes 2000 2000 0 0
17 6 DHCP Snooping Yes 500 500 0 0
18 13 Transit Traffic Yes 1000 1000 0 0
19 10 RPF Failed Yes 250 250 0 0
20 15 MCAST END STATION Yes 2000 2000 0 0
21 13 LOGGING Yes 1000 1000 769024 12016
22 7 Punt Webauth Yes 1000 1000 0 0
23 18 High Rate App Yes 13000 13000 0 0
24 10 Exception Yes 250 250 0 0
25 3 System Critical Yes 1000 1000 0 0
26 10 NFL SAMPLED DATA Yes 250 250 0 0
27 2 Low Latency Yes 5500 5500 0 0
28 10 EGR Exception Yes 250 250 0 0
29 5 Stackwise Virtual OOB Yes 8000 8000 0 0
30 9 MCAST Data Yes 500 500 0 0
31 3 Gold Pkt Yes 1000 1000 0 0
* NOTE: CPU queue policer rates are configured to the closest hardware supported value
CPU Queue Policer Statistics
====================================================================
Policer Policer Accept Policer Accept Policer Drop Policer Drop
Index Bytes Frames Bytes Frames
-------------------------------------------------------------------
0 59894 613 0 0
1 15701689 57082 0 0
2 5562892 63482 0 0
3 3536 52 0 0
4 0 0 0 0
5 0 0 0 0
6 0 0 0 0
7 0 0 0 0
8 2347194476 32649666 0 0
9 0 0 0 0
10 0 0 0 0
11 0 0 0 0
12 0 0 0 0
13 577043 8232 769024 12016
14 719225176 11182355 83027876 1297199
15 132766 1891 0 0
16 0 0 0 0
17 0 0 0 0
18 0 0 0 0
19 0 0 0 0
Second Level Policer Statistics <-- Second level policer information begins here. Catalyst CoPP is organized with two policers to allow for further prioritization of system-critical traffic.
====================================================================
20 2368459057 32770230 0 0
21 719994879 11193091 0 0
Policer Index Mapping and Settings
--------------------------------------------------------------------
level-2 : level-1 (default) (set)
PlcIndex : PlcIndex rate rate
--------------------------------------------------------------------
20 : 1 2 8 13000 17000
21 : 0 4 7 9 10 11 12 13 14 15 6000 6000
====================================================================
Second Level Policer Config
====================================================================
level-1 level-2 level-2
QId PlcIdx PlcIdx Queue Name Enabled
--------------------------------------------------------------------
0 11 21 DOT1X Auth Yes
1 1 20 L2 Control Yes
2 14 21 Forus traffic Yes
3 0 21 ICMP GEN Yes
4 2 20 Routing Control Yes
5 14 21 Forus Address resolution Yes
6 0 21 ICMP Redirect Yes
7 16 - Inter FED Traffic No
8 4 21 L2 LVX Cont Pack Yes
9 19 - EWLC Control No
10 16 - EWLC Data No
11 13 21 L2 LVX Data Pack Yes
12 0 21 BROADCAST Yes
13 10 21 Openflow Yes
14 13 21 Sw forwarding Yes
15 8 20 Topology Control Yes
16 12 21 Proto Snooping Yes
17 6 - DHCP Snooping No
18 13 21 Transit Traffic Yes
19 10 21 RPF Failed Yes
20 15 21 MCAST END STATION Yes
21 13 21 LOGGING Yes
22 7 21 Punt Webauth Yes
23 18 - High Rate App No
24 10 21 Exception Yes
25 3 - System Critical No
26 10 21 NFL SAMPLED DATA Yes
27 2 20 Low Latency Yes
28 10 21 EGR Exception Yes
29 5 - Stackwise Virtual OOB No
30 9 21 MCAST Data Yes
31 3 - Gold Pkt No
CPP Classes to queue map <-- Information on how different traffic types map to different queues are found here.
======================================================================================
PlcIdx CPP Class : Queues
--------------------------------------------------------------------------------------
0 system-cpp-police-data : ICMP GEN/ BROADCAST/ ICMP Redirect/
10 system-cpp-police-sys-data : Openflow/ Exception/ EGR Exception/ NFL SAMPLED DATA/ RPF Failed/
13 system-cpp-police-sw-forward : Sw forwarding/ LOGGING/ L2 LVX Data Pack/ Transit Traffic/
9 system-cpp-police-multicast : MCAST Data/
15 system-cpp-police-multicast-end-station : MCAST END STATION /
7 system-cpp-police-punt-webauth : Punt Webauth/
1 system-cpp-police-l2-control : L2 Control/
2 system-cpp-police-routing-control : Routing Control/ Low Latency/
3 system-cpp-police-system-critical : System Critical/ Gold Pkt/
4 system-cpp-police-l2lvx-control : L2 LVX Cont Pack/
8 system-cpp-police-topology-control : Topology Control/
11 system-cpp-police-dot1x-auth : DOT1X Auth/
12 system-cpp-police-protocol-snooping : Proto Snooping/
6 system-cpp-police-dhcp-snooping : DHCP Snooping/
14 system-cpp-police-forus : Forus Address resolution/ Forus traffic/
5 system-cpp-police-stackwise-virt-control : Stackwise Virtual OOB/
16 system-cpp-default : Inter FED Traffic/ EWLC Data/
18 system-cpp-police-high-rate-app : High Rate App/
19 system-cpp-police-ewlc-control : EWLC Control/
20 system-cpp-police-ios-routing : L2 Control/ Topology Control/ Routing Control/ Low Latency/
21 system-cpp-police-ios-feature : ICMP GEN/ BROADCAST/ ICMP Redirect/ L2 LVX Cont Pack/ Proto Snooping/ Punt Webauth/ MCAST Data/ Transit Traffic/ DOT1X Auth/ Sw forwarding/ LOGGING/ L2 LVX Data Pack/ Forus traffic/ Forus Address resolution/ MCAST END STATION / Openflow/ Exception/ EGR Exception/ NFL SAMPLED DATA/ RPF Failed/
收集有關轉發流量的資訊
這些命令用於收集有關發往CPU的流量的資訊，包括流量的型別和入口的物理點。
- "Show platform software fed <switch> active punt cpuq all"或"Show platform software fed <switch> active punt cpuq <0-31 Queue ID>"可用於檢視與所有或特定CPU隊列相關的統計資訊。
C9300#show platform software fed switch active punt cpuq all Punt CPU Q Statistics =========================================== CPU Q Id : 0 CPU Q Name : CPU_Q_DOT1X_AUTH Packets received from ASIC : 964 Send to IOSd total attempts : 964 Send to IOSd failed count : 0 RX suspend count : 0 RX unsuspend count : 0 RX unsuspend send count : 0 RX unsuspend send failed count : 0 RX consumed count : 0 RX dropped count : 0 RX non-active dropped count : 0 RX conversion failure dropped : 0 RX INTACK count : 964 RX packets dq'd after intack : 0 Active RxQ event : 964 RX spurious interrupt : 0 RX phy_idb fetch failed: 0 RX table_id fetch failed: 0 RX invalid punt cause: 0 CPU Q Id : 1 CPU Q Name : CPU_Q_L2_CONTROL Packets received from ASIC : 80487 Send to IOSd total attempts : 80487 Send to IOSd failed count : 0 RX suspend count : 0 RX unsuspend count : 0 RX unsuspend send count : 0 RX unsuspend send failed count : 0 RX consumed count : 0 RX dropped count : 0 RX non-active dropped count : 0 RX conversion failure dropped : 0 RX INTACK count : 80474 RX packets dq'd after intack : 16 Active RxQ event : 80474 RX spurious interrupt : 9 RX phy_idb fetch failed: 0 RX table_id fetch failed: 0 RX invalid punt cause: 0 CPU Q Id : 2 CPU Q Name : CPU_Q_FORUS_TRAFFIC Packets received from ASIC : 176669 Send to IOSd total attempts : 176669 Send to IOSd failed count : 0 RX suspend count : 0 RX unsuspend count : 0 RX unsuspend send count : 0 RX unsuspend send failed count : 0 RX consumed count : 0 RX dropped count : 0 RX non-active dropped count : 0 RX conversion failure dropped : 0 RX INTACK count : 165584 RX packets dq'd after intack : 12601 Active RxQ event : 165596 RX spurious interrupt : 11851 RX phy_idb fetch failed: 0 RX table_id fetch failed: 0 RX invalid punt cause: 0
<snip>
C9300#show platform software fed switch active punt cpuq 16 <-- Queue ID 16 correlates with Protocol Snooping. Queue IDs can be found in the output of "show platform hardware fedactive qos queue stats internal cpu policer". Punt CPU Q Statistics =========================================== CPU Q Id : 16 CPU Q Name : CPU_Q_PROTO_SNOOPING Packets received from ASIC : 55661 Send to IOSd total attempts : 55661 Send to IOSd failed count : 0 RX suspend count : 0 RX unsuspend count : 0 RX unsuspend send count : 0 RX unsuspend send failed count : 0 RX consumed count : 0 RX dropped count : 0 RX non-active dropped count : 0 RX conversion failure dropped : 0 RX INTACK count : 55659 RX packets dq'd after intack : 9 Active RxQ event : 55659 RX spurious interrupt : 23 RX phy_idb fetch failed: 0 RX table_id fetch failed: 0 RX invalid punt cause: 0 Replenish Stats for all rxq: ------------------------------------------- Number of replenish : 4926842 Number of replenish suspend : 0 Number of replenish un-suspend : 0 -------------------------------------------
- 使用「show platform software fed <switch> active punt cause summary」可快速檢視CPU上出現的所有不同流量型別。請注意，僅顯示非零原因。
C9300#show platform software fed switch active punt cause summary Statistics for all causes Cause Cause Info Rcvd Dropped ------------------------------------------------------------------------------ 7 ARP request or response 142962 0 11 For-us data 490817 0 21 RP<->QFP keepalive 448742 0 24 Glean adjacency 2 0 55 For-us control 415222 0 58 Layer2 bridge domain data packe 3654659 0 60 IP subnet or broadcast packet 37167 0 75 EPC 17942 0 96 Layer2 control protocols 358614 0 97 Packets to LFTS 964 0 109 snoop packets 48867 0 ------------------------------------------------------------------------------
- 使用命令show platform software fed <switch> active punt rate interfaces快速檢視與CPU相關的流量進入系統的介面。此命令僅顯示具有非零輸入隊列的介面。
C9300#show platform software fed switch active punt rates interfaces
Punt Rate on Interfaces Statistics
Packets per second averaged over 10 seconds, 1 min and 5 mins
===========================================================================================
| | Recv | Recv | Recv | Drop | Drop | Drop
Interface Name | IF_ID | 10s | 1min | 5min | 10s | 1min | 5min
===========================================================================================
TenGigabitEthernet1/0/2 0x0000000a 5 5 5 0 0 0
TenGigabitEthernet1/0/23 0x0000001f 1 1 1 0 0 0
-------------------------------------------------------------------------------------------- 使用"show platform software fed <switch> active punt rate interfaces <IF-ID>"可深入檢視介面的單個隊列。此命令顯示聚合統計資訊，並可用於檢視歷史輸入隊列活動以及是否已管制流量。
C9300#show platform software fed switch active punt rates interfaces 0x1f <-- "0x1f" is the IF_ID of Te1/0/23, seen in the previous example.
Punt Rate on Single Interfaces Statistics
Interface : TenGigabitEthernet1/0/23 [if_id: 0x1F]
Received Dropped
-------- -------
Total : 1010652 Total : 0
10 sec average : 1 10 sec average : 0
1 min average : 1 1 min average : 0
5 min average : 1 5 min average : 0
Per CPUQ punt stats on the interface (rate averaged over 10s interval)
==========================================================================
Q | Queue | Recv | Recv | Drop | Drop |
no | Name | Total | Rate | Total | Rate |
==========================================================================
0 CPU_Q_DOT1X_AUTH 0 0 0 0
1 CPU_Q_L2_CONTROL 9109 0 0 0
2 CPU_Q_FORUS_TRAFFIC 176659 0 0 0
3 CPU_Q_ICMP_GEN 0 0 0 0
4 CPU_Q_ROUTING_CONTROL 447374 0 0 0
5 CPU_Q_FORUS_ADDR_RESOLUTION 80693 0 0 0
6 CPU_Q_ICMP_REDIRECT 0 0 0 0
7 CPU_Q_INTER_FED_TRAFFIC 0 0 0 0
8 CPU_Q_L2LVX_CONTROL_PKT 0 0 0 0
9 CPU_Q_EWLC_CONTROL 0 0 0 0
10 CPU_Q_EWLC_DATA 0 0 0 0
11 CPU_Q_L2LVX_DATA_PKT 0 0 0 0
12 CPU_Q_BROADCAST 22680 0 0 0
13 CPU_Q_CONTROLLER_PUNT 0 0 0 0
14 CPU_Q_SW_FORWARDING 0 0 0 0
15 CPU_Q_TOPOLOGY_CONTROL 271014 0 0 0
16 CPU_Q_PROTO_SNOOPING 0 0 0 0
17 CPU_Q_DHCP_SNOOPING 0 0 0 0
18 CPU_Q_TRANSIT_TRAFFIC 0 0 0 0
19 CPU_Q_RPF_FAILED 0 0 0 0
20 CPU_Q_MCAST_END_STATION_SERVICE 2679 0 0 0
21 CPU_Q_LOGGING 444 0 0 0
22 CPU_Q_PUNT_WEBAUTH 0 0 0 0
23 CPU_Q_HIGH_RATE_APP 0 0 0 0
24 CPU_Q_EXCEPTION 0 0 0 0
25 CPU_Q_SYSTEM_CRITICAL 0 0 0 0
26 CPU_Q_NFL_SAMPLED_DATA 0 0 0 0
27 CPU_Q_LOW_LATENCY 0 0 0 0
28 CPU_Q_EGR_EXCEPTION 0 0 0 0
29 CPU_Q_FSS 0 0 0 0
30 CPU_Q_MCAST_DATA 0 0 0 0
31 CPU_Q_GOLD_PKT 0 0 0 0
--------------------------------------------------------------------------
檢查CPU繫結的流量
Catalyst 9000系列交換機提供用於監控和檢視CPU流量的實用程式。使用這些工具瞭解哪些流量被主動轉發到CPU。
內嵌式封包擷取(EPC)
控制平面上的EPC可在任一方向（或雙向）上完成。 對於轉發流量，捕獲入站。控制平面上的EPC可以儲存到緩衝區或檔案。
C9300#monitor capture CONTROL control-plane in match any buffer circular size 10
C9300#show monitor capture CONTROL parameter <-- Check to ensure parameters are as expected. monitor capture CONTROL control-plane IN monitor capture CONTROL match any monitor capture CONTROL buffer size 10 circular C9300#monitor capture CONTROL start <-- Starts the capture. Started capture point : CONTROL C9300#monitor capture CONTROL stop <-- Stops the capture. Capture statistics collected at software: Capture duration - 5 seconds Packets received - 39 Packets dropped - 0 Packets oversized - 0 Bytes dropped in asic - 0 Capture buffer will exists till exported or cleared Stopped capture point : CONTROL
捕獲結果既可在簡短的輸出中檢視，也可在詳細的輸出中檢視。
C9300#show monitor capture CONTROL buffer brief
Starting the packet display ........ Press Ctrl + Shift + 6 to exit
1 0.000000 5c:5a:c7:61:4c:5f -> 00:00:04:00:0e:00 ARP 64 192.168.10.1 is at 5c:5a:c7:61:4c:5f
2 0.030643 00:00:00:00:00:00 -> 00:06:df:f7:20:01 0x0000 30 Ethernet II
3 0.200016 5c:5a:c7:61:4c:5f -> 00:00:04:00:0e:00 ARP 64 192.168.10.1 is at 5c:5a:c7:61:4c:5f
4 0.400081 5c:5a:c7:61:4c:5f -> 00:00:04:00:0e:00 ARP 64 192.168.10.1 is at 5c:5a:c7:61:4c:5f
5 0.599962 5c:5a:c7:61:4c:5f -> 00:00:04:00:0e:00 ARP 64 192.168.10.1 is at 5c:5a:c7:61:4c:5f
6 0.800067 5c:5a:c7:61:4c:5f -> 00:00:04:00:0e:00 ARP 64 192.168.10.1 is at 5c:5a:c7:61:4c:5f
7 0.812456 00:1b:0d:a5:e2:a5 -> 01:80:c2:00:00:00 STP 60 RST. Root = 0/10/00:1b:53:bb:91:00 Cost = 19 Port = 0x8025
8 0.829809 10.122.163.3 -> 224.0.0.2 HSRP 92 Hello (state Active)
9 0.981313 10.122.163.2 -> 224.0.0.13 PIMv2 72 Hello
10 1.004747 5c:5a:c7:61:4c:5f -> 00:00:04:00:0e:00 ARP 64 192.168.10.1 is at 5c:5a:c7:61:4c:5f
11 1.200082 5c:5a:c7:61:4c:5f -> 00:00:04:00:0e:00 ARP 64 192.168.10.1 is at 5c:5a:c7:61:4c:5f
12 1.399987 5c:5a:c7:61:4c:5f -> 00:00:04:00:0e:00 ARP 64 192.168.10.1 is at 5c:5a:c7:61:4c:5f
13 1.599944 5c:5a:c7:61:4c:5f -> 00:00:04:00:0e:00 ARP 64 192.168.10.1 is at 5c:5a:c7:61:4c:5f
<snip>
C9300#show monitor capture CONTROL buffer detail | begin Frame 7
Frame 7: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface /tmp/epc_ws/wif_to_ts_pipe, id 0
Interface id: 0 (/tmp/epc_ws/wif_to_ts_pipe)
Interface name: /tmp/epc_ws/wif_to_ts_pipe
Encapsulation type: Ethernet (1)
Arrival Time: May 3, 2023 23:58:11.727432000 UTC
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1683158291.727432000 seconds
[Time delta from previous captured frame: 0.012389000 seconds]
[Time delta from previous displayed frame: 0.012389000 seconds]
[Time since reference or first frame: 0.812456000 seconds]
Frame Number: 7
Frame Length: 60 bytes (480 bits)
Capture Length: 60 bytes (480 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:llc:stp]
IEEE 802.3 Ethernet
Destination: 01:80:c2:00:00:00 (01:80:c2:00:00:00)
Address: 01:80:c2:00:00:00 (01:80:c2:00:00:00)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
Source: 00:1b:0d:a5:e2:a5 (00:1b:0d:a5:e2:a5)
Address: 00:1b:0d:a5:e2:a5 (00:1b:0d:a5:e2:a5)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Length: 39
Padding: 00000000000000
Logical-Link Control
DSAP: Spanning Tree BPDU (0x42)
0100 001. = SAP: Spanning Tree BPDU
.... ...0 = IG Bit: Individual
SSAP: Spanning Tree BPDU (0x42)
0100 001. = SAP: Spanning Tree BPDU
.... ...0 = CR Bit: Command
Control field: U, func=UI (0x03)
000. 00.. = Command: Unnumbered Information (0x00)
.... ..11 = Frame type: Unnumbered frame (0x3)
Spanning Tree Protocol
Protocol Identifier: Spanning Tree Protocol (0x0000)
Protocol Version Identifier: Rapid Spanning Tree (2)
BPDU Type: Rapid/Multiple Spanning Tree (0x02)
BPDU flags: 0x3c, Forwarding, Learning, Port Role: Designated
0... .... = Topology Change Acknowledgment: No
.0.. .... = Agreement: No
..1. .... = Forwarding: Yes
...1 .... = Learning: Yes
.... 11.. = Port Role: Designated (3)
.... ..0. = Proposal: No
.... ...0 = Topology Change: No
Root Identifier: 0 / 10 / 00:1b:53:bb:91:00
Root Bridge Priority: 0
Root Bridge System ID Extension: 10
Root Bridge System ID: 00:1b:53:bb:91:00 (00:1b:53:bb:91:00)
Root Path Cost: 19
Bridge Identifier: 32768 / 10 / 00:1b:0d:a5:e2:80
Bridge Priority: 32768
Bridge System ID Extension: 10
Bridge System ID: 00:1b:0d:a5:e2:80 (00:1b:0d:a5:e2:80)
Port identifier: 0x8025
Message Age: 1
Max Age: 20
Hello Time: 2
Forward Delay: 15
Version 1 Length: 0
C9300#monitor capture CONTROL buffer display-filter "frame.number==9" detailed <-- Most Wireshark display filters are supported.
Starting the packet display ........ Press Ctrl + Shift + 6 to exit
Frame 9: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface /tmp/epc_ws/wif_to_ts_pipe, id 0
Interface id: 0 (/tmp/epc_ws/wif_to_ts_pipe)
Interface name: /tmp/epc_ws/wif_to_ts_pipe
Encapsulation type: Ethernet (1)
Arrival Time: May 4, 2023 00:07:44.912567000 UTC
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1683158864.912567000 seconds
[Time delta from previous captured frame: 0.123942000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 1.399996000 seconds]
Frame Number: 9
Frame Length: 64 bytes (512 bits)
Capture Length: 64 bytes (512 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:vlan:ethertype:arp]
Ethernet II, Src: 5c:5a:c7:61:4c:5f (5c:5a:c7:61:4c:5f), Dst: 00:00:04:00:0e:00 (00:00:04:00:0e:00)
Destination: 00:00:04:00:0e:00 (00:00:04:00:0e:00)
Address: 00:00:04:00:0e:00 (00:00:04:00:0e:00)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: 5c:5a:c7:61:4c:5f (5c:5a:c7:61:4c:5f)
Address: 5c:5a:c7:61:4c:5f (5c:5a:c7:61:4c:5f)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: 802.1Q Virtual LAN (0x8100)
802.1Q Virtual LAN, PRI: 0, DEI: 0, ID: 10
000. .... .... .... = Priority: Best Effort (default) (0)
...0 .... .... .... = DEI: Ineligible
.... 0000 0000 1010 = ID: 10
Type: ARP (0x0806)
Padding: 0000000000000000000000000000
Trailer: 00000000
Address Resolution Protocol (reply)
Hardware type: Ethernet (1)
Protocol type: IPv4 (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: reply (2)
Sender MAC address: 5c:5a:c7:61:4c:5f (5c:5a:c7:61:4c:5f)
Sender IP address: 192.168.10.1
Target MAC address: 00:00:04:00:0e:00 (00:00:04:00:0e:00)
Target IP address: 192.168.10.25
捕獲結果可以直接寫入檔案，也可以從緩衝區匯出。
C9300#monitor capture CONTROL export location flash:control.pcap <-- Exports the current buffer to file. Extension '.pcap' is used so the file can be immediately opened by Wireshark, once moved from the switch.. Export Started Successfully Export completed for capture point CONTROL
C9300#
C9300#dir flash: | in control.pcap 475231 -rw- 3972 May 4 2023 00:00:38 +00:00 control.pcap C9300#
FED CPU資料包捕獲
Catalyst 9000系列交換器支援偵錯公用程式，可增強與CPU之間的封包可見性。
C9300#debug platform software fed switch active punt packet-capture ? buffer Configure packet capture buffer clear-filter Clear punt PCAP filter set-filter Specify wireshark like filter (Punt PCAP) start Start punt packet capturing stop Stop punt packet capturing
C9300#$re fed switch active punt packet-capture buffer limit 16384
Punt PCAP buffer configure: one-time with buffer size 16384...done
C9300#show platform software fed switch active punt packet-capture status Punt packet capturing: disabled. Buffer wrapping: disabled Total captured so far: 0 packets. Capture capacity : 16384 packets C9300#debug platform software fed switch active punt packet-capture start Punt packet capturing started. C9300#debug platform software fed switch active punt packet-capture stop Punt packet capturing stopped. Captured 55 packet(s)
緩衝區內容包含用於輸出的簡要和詳細選項。
C9300#show platform software fed switch active punt packet-capture brief Punt packet capturing: disabled. Buffer wrapping: disabled Total captured so far: 55 packets. Capture capacity : 16384 packets ------ Punt Packet Number: 1, Timestamp: 2023/05/04 00:17:41.709 ------ interface : physical: TenGigabitEthernet1/0/2[if-id: 0x0000000a], pal: TenGigabitEthernet1/0/2 [if-id: 0x0000000a] <-- Brief output provides most actionable information, including where the packet ingressed the switch, punt reason and punt queue. metadata : cause: 109 [snoop packets], sub-cause: 1, q-no: 16, linktype: MCP_LINK_TYPE_IP [1] ether hdr : dest mac: 0000.0400.0e00, src mac: 5c5a.c761.4c5f ether hdr : vlan: 10, ethertype: 0x8100 ------ Punt Packet Number: 2, Timestamp: 2023/05/04 00:17:41.909 ------ interface : physical: TenGigabitEthernet1/0/2[if-id: 0x0000000a], pal: TenGigabitEthernet1/0/2 [if-id: 0x0000000a] metadata : cause: 109 [snoop packets], sub-cause: 1, q-no: 16, linktype: MCP_LINK_TYPE_IP [1] ether hdr : dest mac: 0000.0400.0e00, src mac: 5c5a.c761.4c5f ether hdr : vlan: 10, ethertype: 0x8100 ------ Punt Packet Number: 3, Timestamp: 2023/05/04 00:17:42.109 ------ interface : physical: TenGigabitEthernet1/0/2[if-id: 0x0000000a], pal: TenGigabitEthernet1/0/2 [if-id: 0x0000000a] metadata : cause: 109 [snoop packets], sub-cause: 1, q-no: 16, linktype: MCP_LINK_TYPE_IP [1] ether hdr : dest mac: 0000.0400.0e00, src mac: 5c5a.c761.4c5f ether hdr : vlan: 10, ethertype: 0x8100 ------ Punt Packet Number: 4, Timestamp: 2023/05/04 00:17:42.309 ------ interface : physical: TenGigabitEthernet1/0/2[if-id: 0x0000000a], pal: TenGigabitEthernet1/0/2 [if-id: 0x0000000a] metadata : cause: 109 [snoop packets], sub-cause: 1, q-no: 16, linktype: MCP_LINK_TYPE_IP [1] ether hdr : dest mac: 0000.0400.0e00, src mac: 5c5a.c761.4c5f ether hdr : vlan: 10, ethertype: 0x8100 ------ Punt Packet Number: 5, Timestamp: 2023/05/04 00:17:42.509 ------ interface : physical: TenGigabitEthernet1/0/2[if-id: 0x0000000a], pal: TenGigabitEthernet1/0/2 [if-id: 0x0000000a] metadata : cause: 109 [snoop packets], sub-cause: 1, q-no: 16, linktype: MCP_LINK_TYPE_IP [1] ether hdr : dest mac: 0000.0400.0e00, src mac: 5c5a.c761.4c5f ether hdr : vlan: 10, ethertype: 0x8100
C9300#show platform software fed switch active punt packet-capture detailed <-- Detailed provides the same information as brief, but also additional details including the packet payload in hexidecimal and additional frame descriptors. Punt packet capturing: disabled. Buffer wrapping: disabled Total captured so far: 55 packets. Capture capacity : 16384 packets ------ Punt Packet Number: 1, Timestamp: 2023/05/04 00:17:41.709 ------ interface : physical: TenGigabitEthernet1/0/2[if-id: 0x0000000a], pal: TenGigabitEthernet1/0/2 [if-id: 0x0000000a] metadata : cause: 109 [snoop packets], sub-cause: 1, q-no: 16, linktype: MCP_LINK_TYPE_IP [1] ether hdr : dest mac: 0000.0400.0e00, src mac: 5c5a.c761.4c5f ether hdr : vlan: 10, ethertype: 0x8100 Packet Data Hex-Dump (length: 68 bytes) : 000004000E005C5A C7614C5F8100000A 0806000108000604 00025C5AC7614C5F C0A80A0100000400 0E00C0A80A190000 0000000000000000 0000000000000000 E9F1C9F3 Doppler Frame Descriptor : fdFormat = 0x4 systemTtl = 0xe loadBalHash1 = 0x20 loadBalHash2 = 0xc spanSessionMap = 0 forwardingMode = 0 destModIndex = 0 skipIdIndex = 0 srcGpn = 0x2 qosLabel = 0x83 srcCos = 0 ingressTranslatedVlan = 0x7 bpdu = 0 spanHistory = 0 sgt = 0 fpeFirstHeaderType = 0 srcVlan = 0xa rcpServiceId = 0x1 wccpSkip = 0 srcPortLeIndex = 0x1 cryptoProtocol = 0 debugTagId = 0 vrfId = 0 saIndex = 0 pendingAfdLabel = 0 destClient = 0x1 appId = 0 finalStationIndex = 0x74 decryptSuccess = 0 encryptSuccess = 0 rcpMiscResults = 0 stackedFdPresent = 0 spanDirection = 0 egressRedirect = 0 redirectIndex = 0 exceptionLabel = 0 destGpn = 0 inlineFd = 0x1 suppressRefPtrUpdate = 0 suppressRewriteSideEfects = 0 cmi2 = 0 currentRi = 0x1 currentDi = 0x527b dropIpUnreachable = 0 srcZoneId = 0 srcAsicId = 0 originalDi = 0 originalRi = 0 srcL3IfIndex = 0x27 dstL3IfIndex = 0 dstVlan = 0 frameLength = 0x44 fdCrc = 0x97 tunnelSpokeId = 0 isPtp = 0 ieee1588TimeStampValid = 0 ieee1588TimeStamp55_48 = 0 lvxSourceRlocIpAddress = 0 sgtCachingNeeded = 0 Doppler Frame Descriptor Hex-Dump : 0000000044004E04 000B40977B520000 0000000000000100 000000070A000000 0000000001000010 0000000074000100 0000000027830200 0000000000000000
可使用許多顯示過濾器。支援最常見的Wireshark顯示過濾器。
C9300#show platform software fed switch active punt packet-capture display-filter-help FED Punject specific filters : 1. fed.cause FED punt or inject cause 2. fed.linktype FED linktype 3. fed.pal_if_id FED platform interface ID 4. fed.phy_if_id FED physical interface ID 5. fed.queue FED Doppler hardware queue 6. fed.subcause FED punt or inject sub cause Generic filters supported : 7. arp Is this an ARP packet 8. bootp DHCP packets [Macro] 9. cdp Is this a CDP packet 10. eth Does the packet have an Ethernet header 11. eth.addr Ethernet source or destination MAC address 12. eth.dst Ethernet destination MAC address 13. eth.ig IG bit of ethernet destination address (broadcast/multicast) 14. eth.src Ethernet source MAC address 15. eth.type Ethernet type 16. gre Is this a GRE packet 17. icmp Is this a ICMP packet 18. icmp.code ICMP code 19. icmp.type ICMP type 20. icmpv6 Is this a ICMPv6 packet 21. icmpv6.code ICMPv6 code 22. icmpv6.type ICMPv6 type 23. ip Does the packet have an IPv4 header 24. ip.addr IPv4 source or destination IP address 25. ip.dst IPv4 destination IP address 26. ip.flags.df IPv4 dont fragment flag 27. ip.flags.mf IPv4 more fragments flag 28. ip.frag_offset IPv4 fragment offset 29. ip.proto Protocol used in datagram 30. ip.src IPv4 source IP address 31. ip.ttl IPv4 time to live 32. ipv6 Does the packet have an IPv4 header 33. ipv6.addr IPv6 source or destination IP address 34. ipv6.dst IPv6 destination IP address 35. ipv6.hlim IPv6 hop limit 36. ipv6.nxt IPv6 next header 37. ipv6.plen IPv6 payload length 38. ipv6.src IPv6 source IP address 39. stp Is this a STP packet 40. tcp Does the packet have a TCP header 41. tcp.dstport TCP destination port 42. tcp.port TCP source OR destination port 43. tcp.srcport TCP source port 44. udp Does the packet have a UDP header 45. udp.dstport UDP destination port 46. udp.port UDP source OR destination port 47. udp.srcport UDP source port 48. vlan.id Vlan ID (dot1q or qinq only) 49. vxlan Is this a VXLAN packet C9300#show platform software fed switch active punt packet-capture display-filter arp brief Punt packet capturing: disabled. Buffer wrapping: disabled Total captured so far: 55 packets. Capture capacity : 16384 packets ------ Punt Packet Number: 1, Timestamp: 2023/05/04 00:17:41.709 ------ interface : physical: TenGigabitEthernet1/0/2[if-id: 0x0000000a], pal: TenGigabitEthernet1/0/2 [if-id: 0x0000000a] metadata : cause: 109 [snoop packets], sub-cause: 1, q-no: 16, linktype: MCP_LINK_TYPE_IP [1] ether hdr : dest mac: 0000.0400.0e00, src mac: 5c5a.c761.4c5f ether hdr : vlan: 10, ethertype: 0x8100 ------ Punt Packet Number: 2, Timestamp: 2023/05/04 00:17:41.909 ------ interface : physical: TenGigabitEthernet1/0/2[if-id: 0x0000000a], pal: TenGigabitEthernet1/0/2 [if-id: 0x0000000a] metadata : cause: 109 [snoop packets], sub-cause: 1, q-no: 16, linktype: MCP_LINK_TYPE_IP [1] ether hdr : dest mac: 0000.0400.0e00, src mac: 5c5a.c761.4c5f ether hdr : vlan: 10, ethertype: 0x8100
<snip>
過濾器也可以作為捕獲過濾器應用。
C9300#show platform software fed switch active punt packet-capture set-filter arp <-- Most common Wireshark filters are supported. For multi-worded filters, use "" ("ip.src==192.168.1.1").
Filter setup successful. Captured packets will be cleared
C9300#$e fed switch active punt packet-capture status
Punt packet capturing: disabled. Buffer wrapping: disabled
Total captured so far: 0 packets. Capture capacity : 16384 packets
Capture filter : "arp"常見方案
對本地IP的間歇ICMP(Ping)丟失
轉送到交換器上本地IP的流量會棄置在Forus（字面意思是「for us」）隊列中。Forus CoPP隊列中的增量與目的地為本地交換機的丟棄資料包有關。這相對直截了當，而且易於概念化。
但是，在某些情況下，本地目的地流量可能會丟失，這些流量與Forus丟棄沒有明確關聯。
如果流量具有足夠的CPU流量，則點路徑會變得過度飽和，超出了CoPP優先處理被管制流量的能力。流量以先入先出方式進行「靜默式」監管。
在此案例中，可以看到大量控制平面策略的證據，但相關的流量型別（在本例中為Forus）不一定主動增加。
總而言之，如果CPU繫結的流量異常大（通過活動CoPP管制和資料包捕獲或FED突發調試來證明），則可能會出現與您正在故障排除的隊列不一致的丟失。在此案例中，確定為什麼CPU佔用流量過大，並採取措施減輕控制平面的負擔。
高ICMP重定向和緩慢DHCP操作
Catalyst 9000系列交換機上的CoPP被組織為32個硬體隊列。這32個硬體隊列與20個單獨的管制器索引相對應。 每個策略器索引與一個或多個硬體隊列相關聯。
從功能上說，這意味著多個流量類別共用一個監察器索引，並受同一個聚合監察器值的支配。
在已啟用DHCP中繼代理的交換機上出現的一個常見問題是DHCP響應緩慢。客戶端可以偶爾獲得IP，但需要多次嘗試才能完成，並且某些客戶端會超時。
ICMP重定向隊列和廣播隊列共用一個管制器索引，因此在同一交換機虛擬介面(SVI)上接收和路由出的大量流量會影響依賴廣播流量的應用程式。 當交換器作為中繼代理時，這一點尤其明顯。
本檔案將深入說明這個概念以及如何減輕：排除Catalyst 9000 DHCP中繼代理上的DHCP故障
其他資源
排除Catalyst 9000 DHCP中繼代理上的慢速或間歇性DHCP故障
在Catalyst 9000交換機上配置FED CPU資料包捕獲
配置資料包捕獲 — 網路管理配置指南，Cisco IOS XE Bengaluru 17.6.x（Catalyst 9300交換機）
修訂記錄
| 修訂 | 發佈日期 | 意見 |
|---|---|---|
1.0 |
02-Apr-2024
|
初始版本 |
由思科工程師貢獻
- Jason BabbCisco TAC
意見