jrpavel3
join:2002-03-16
UK
| reply to tdoran
Re: [HELP] IOS IPS -- Is the performance hit worth it?
Well I am still not much further forward even with 12.4(11)T2.
The CPU is still maxed out downloading at roughly 1MB/s.
What I had not noticed before was that it is interrupts and not cpu that is sapping the cpu. Eg, the cpus is at 95%, with 89% accounted for by interrupts.
CPU utilization for five seconds: 95%/89%; one minute: 41%; five minutes: 12%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
4 2232292 112872 19777 2.83% 1.26% 1.23% 0 Check heaps
41 1101908 828463 1330 1.02% 0.99% 0.64% 0 COLLECT STAT COU
77 50776 6442 7882 0.48% 0.10% 0.02% 2 Virtual Exec
79 122432 136100 899 0.16% 0.13% 0.08% 0 IP Input
47 28804 2023517 14 0.16% 0.03% 0.00% 0 Dot11 driver
211 21964 146202 150 0.16% 0.04% 0.01% 0 HyBridge Input P
2 9992 33229 300 0.08% 0.01% 0.00% 0 Load Meter
207 16004 5152782 3 0.08% 0.02% 0.00% 0 PPP manager
213 10588 257205 41 0.08% 0.01% 0.00% 0 Spanning Tree
111 2224 82940 26 0.08% 0.00% 0.00% 0 ILMI Timer Proce
I had expected the problem to be the cpu spending its time matching incoming traffic to the IPS signatures, but clearly something else is going on.
Does anyone have any pointers as to how to track this down? |
