H3C路由器异常cpu利用率高故障排查

1、q4 /o%0QN1S817/0%09HIA161781/0%0Qd9VP 吹/O%0Doin17901 /O%0dll】paOll /O%03 11g /O%0DSaqi79l /O%0OS%叫宓 /O%0SIPZ7K /O%0IA1DV6ZEZ. /O%0dIAIMDeaOl /O%0我d/O%0QN0Z.IB3 /O%0QA1Az.pq /O%0IdlNZ.3ZPI /O%0H1S3SS41 /O%0HISd顷叮 /O%0VON0S179SI /O%0dlP17I4I /O%0d的/O%0ddDV3163 /O%0danSPB /O%0d9VHPP6Z /O%0join119 /O%0d

2、QNqqq。 /o%01S1DSiaiz /O%0dVDeO /O%0dlSIAlZ19 /O%0wsz. /O%01DVKES /O%0MldSssqsisz/o%9DOS33931 /O%0A3QPPEZ /O%0OdNIJS既/O%0lAlDdlPZEOl /O%0山1。P30086H/0dlJQES116S /OHIA11S0。能人 /O%0DI1/O1QIA(mo pi nd3/M!H P! nd3)a!iunyndDaiue|sei|sei ndD Ae|dsipM9IA-UJ91SAs(sanuiuj)l/l3SAS)ssinuiLU 09 ise| sesn-nd309OS01

3、700301#|%S#|%0T#|%ST# # # # | %0Z# #1%宓#|%0#1%能#|%0。#l%S。#|%0S#|%SS#|%09#|%S9#l%OZ#l%SZ.#|%08#|%S8#|%06#l%S6#|%00liq ndD Ae|dsipsanuiuj g jse| ui %/_sinuiuu I ise| ui %glspuooes g jse| ui %8l：9Sesn ndDliunndD Ae|dsip首哥剿算皇平IROUT0%IPP0%SIP0%TSsm0%WIDS0%IFNT0%vt20%display task血 4* *-WVW*B VW W A- / / /

4、O / / w O / /000 00196fbc 23c6 1518f149da17427 309b 3ba146INTO 33dc3c00 340N 100 nnrmiTeadN 8012/8/0Display task 18H3C hieaudH3C瑚Je却却或upLav task 18Taskname:INFOTaskPLAT IndeE:ISTaskOS Index:0r3水TaskStackTpp:OiE03;Taskpriority:10CTaskStatus:njLastrun t ime CPU Tick) :OeO (hiMax Tun time (CPU Ticlc) :

5、 OtO ChiIart al run due (CPU Tick); 0 x4 OdStack Ififormation：O/8022d7SOOi8023L3dcOs80231ba80i313e48cOiS13dc6aO0z13dc234c“Ei 皓 Jtq?-抓取信息交予H3C 400分析CPU不稳定增高并到100%,导致业务不正常，查看进程DrTF52%0/119800ed为系统转发进程。路由器流量上送CPU。判定为系统流量过大（可能内网用户中毒攻击）2、Display logb查看日志 看是否由事件发生(如SSH登陆攻击 路由表动荡、更改配置导致cpu 飙高)DIS TRAP查看告警信

6、息3、Disp interface查看流量比例error crc广播组播报文附：dis int gi10/0GigabitEthernet10/0 current state: UPLine protocol current state: UPDescription: To-75E-IRFThe Maximum Transmit Unit is 1500Internet Address is 10.10.10.1/29 PrimaryIP Packet Frame Type: PKTFMT_ETHNT_2, Hardware Address: 000f-e261-591eIPv6 Packet

7、 Frame Type: PKTFMT_ETHNT_2, Hardware Address: 000f-e261-591eMedia type is twisted pair, loopback not set, promiscuous mode not set1000Mb/s, Full-duplex, link type is autonegotiationOutput flow-control is disabled, input flow-control is disabledOutput queue : (Urgent queuing : Size/Length/Discards)

8、0/100/0Output queue : (Protocol queuing : Size/Length/Discards) 0/500/0Output queue : (FIFO queuing : Size/Length/Discards) 0/75/221Last clearing of counters: 12:29:44 Sat 07/18/2015Last 300 seconds input rate 789998.56 bytes/sec, 6319988 bits/sec, 3205.15 packets/secLast 300 seconds output rate 342

9、2041.50 bytes/sec, 27376332 bits/sec, 4266.08 packets/secInput: 675942856 packets, 338066929 bytes, 675942856 buffers2047 broadcasts, 4064 multicasts, 0 pauses13914594 errors, 0 runts, 0 giants1 crc, 0 align errors, 0 overruns0 dribbles, 0 drops, 13914593 no buffersOutput:852596260 packets, 31928309

10、05 bytes, 852596260 buffers911 broadcasts, 0 multicasts, 0 pauses0 errors, 0 underruns, 0 collisions0 deferred, 0 lost carriers判断受攻击的端口(内网、外网eth2/0 gi0/1 gi0/2端口)查看cpu情况如：切断内网口 gi10/0 cpu利用率会下降4、对内网口进行抓包分析具体的报文定义ACL抓包对inbound方向acl number 2100rule 10 permitint gi10/0firewall packet-filter 2100 inquit

11、debugging ip packet acl 2100ter mter deb5、连接笔记本用wireshare抓包进行分析,3*.W X.V MV I JXU* i* H WW X V-L X.JXi J 7n r X, J JR-DV !U UU IFXu I 4.14 I I X n0 2ttLJ-07-2O lC：4O9il60KMKi 1?2,16,1W-200 1 2015-07-20 10:52!40.11732000 172.1. IK-ZOD113,145.153. 39 21B. GC. 171. HS201.-07-20 10：S2：4a. jl&SDlOK 172.

12、16.L. L31.SV.71?5 STaridard q些w OmcHIj 村岫L nndrcm75 EMdhd0心dlb a vMil. 12hir2.cci2 2oi-D7-zo iu：j：4a. ne.E74anu its.is. ico.qd4 ZO15-D7-ZC% 2filS-C7-2Ci4 2ttL5-fl?-2O7 2015-07-20 2015-07-209 2015-07-200 2O1T-D7-2OLO；32；4Q.21&5B5QQO 10:52:0 J1M9WM 15:5.2:40 J1&904000 10：5i2：d0n51691K)M 10:52:40. 31E-

13、322atiO 10!S2!40.216QZ2aDO 10:12:40. 21M4iaKiirZ,lC.lTO.2C!Q 172.16.IM 300 172.16.100 200 172.16.100 2001M.20D1M.2C1D 172.1ft. im.lQD1 Z015-D7-Z0 li：i：52：-4a. 116950300 lfZ.16. 1CO.2C1DL-131. 59. TO 21B.5.73.113 218.5.73.134 121.lJ.15d.23Q 113.1O5.15S. 38 21B. 5.73.134 jib. st. m.7 113-. 105.15a. 3Q 121. 14. 154.2 3DQHSMS*50*5 HSOHS dhs75 StandArd quary Dic-ddLbmnwI. IzirlrJ.CQVi75 Standd Stiand-u-d Standard ST 站 stands d scandArd tandd StandardDiOdLbA HMM1. IzmirJ.EOA Qx-eriLb A NwwllznirJbCiij Owdlb i IrnirJntair 0;祯血 b