网吧故障案例分析.docVIP

网吧故障案例分析 2006年10月，新华下接网吧用户网络游戏有较频繁的停顿现象同时PING网关时延大。 故障分析 登录新华ERX 1410），查看SRP及线卡CPU利用率，现SRP和提供用户接入的第11槽GE卡CPU利用率都在80%左右。 gi 11/0流量做增量检查，发现ge 11/0平均每秒收到有270个左右的广播包广播包CHN-Telecom#base int gi 11/0 CHN-Telecom#sleep 10 Please wait.... CHN-Telecom#sh int gi 11/0 del GigabitEthernet11/0 is Up, Administrative status is Up ... ... In: Bytes 128129365, Unicast 616837 Multicast 18, Broadcast 2698 10秒钟内的广播包数量 Errors 0, Discards 0, Mac Errors 0, Alignment 0 CRC 0, Too Longs 0, Symbol Errors 0 Out: Bytes 310763989, Unicast 536096 Multicast 0, Broadcast 50 Errors 0, Discards 0, Mac Errors 0, Deferred 0, No Carrier 0 Collisions: Single 0, Multiple 0, Late 0, Excessive 0 ARP Statistics: In: ARP requests 0, ARP responses 0 Errors 0, Discards 0 Out: ARP requests 0, ARP responses 0 Errors 0, Discards 0 ... ... 通过检查汇聚交换机3552的接口发现水碾河接入交换机送出大量广播包，登录水碾河接入交换机，发现E1/1收到大量广播包，约占所收数据帧的25% （1591478417/6475417162=24.5%）接口，故障消失。SNH-J-HW3026FS-1display interface Ethernet 1/1 ... ... Input(total): 6475417162 packets, 1125684395363 bytes 1591478417 broadcasts, 3 multicasts Input(normal): - packets, - bytes - broadcasts, - multicasts Input: 1 input errors, 0 runts, 0 giants, - throttles, 0 CRC 0 frame, - overruns, 0 aborts, 1 ignored, - parity errors Output(total): 8859379452 packets, 3126300122146 bytes 810191 broadcasts, 210455 multicasts, 0 pauses Output(normal): - packets, - bytes - broadcasts, - multicasts, - pauses Output: 0 output errors, 0 underruns, - buffer failures - aborts, 0 deferred, 0 collisions, 0 late collisions - lost carrier, - no carrier ... ... 到用户现场后，用PC替换用户网吧路由器NetCore 2805NR，用thereal抓包，发现有从以下地址来的UDP包。抓包 故障原因 从上述测试结果来看，出现这种现象是由于网吧用户受到异常流量冲击，一方面消耗了中继带宽资源，另一方面，网吧路由器软件BUG，大量的UDP异常流量冲击时，发出大量ARP网关解析请求，清耗ERX的线卡和SRP的CPU资源，导致PING网关慢及掉包。