On Sat, Jul 13, 2002 at 11:31:58AM -0700, Ambrose_Earle@shamrockfoods.com wrote:
Because the traffic flows over a vif, I can only capture the entire vif and not an individual interface. I also do not know how our 6509 was configured, so I can't attempt to calculate over which port the traffic from this client would be directed, but the amount and type of traffic leads me to believe that I have found the culprit. This particular application server runs a program within a DOS on a Windows 98 PC. It sends hundreds of search requests at exactly the same time as the CPU spikes. Researching this shows some related bugs - 35047 or 40348.
Ah, perhaps this is due to how vifs are implemented on Cisco; AFAIR, the exact port over which to transfer the data is computed (!) based on source and destination MAC.
p.