Detect routers operating in process-switching mode

Sometimes the CPU utilization on a router would raise unexpectedly due to incoming packets being process switched. A very common scenario is a GRE tail-end router that has to reassemble IP fragments (usually generated due to incorrect MTU size on the GRE head-end or due to IPSec+GRE combination) or a router under Denial-of-Service attack. To detect these conditions, you can define Embedded Resource Manager (ERM) policy that raises an alert when the CPU utilization of the IP Input process exceeds predefined limits.
resource policy
  policy HighProcCPU type iosprocess
    cpu process
     critical rising 40 falling 25
     major rising 20 falling 10

  user group IPInput type iosprocess
   instance "IP Input"
   policy HighProcCPU
And here are some more ERM usage guidelines:
  • This time, we're monitoring a group of processes, so the policy definition is no longer global but has a type (iosprocess is the only type defined at the moment).
  • As in the previous ERM example, we're monitoring CPU utilization of the main CPU (system), but this time we're interested in the process utilization.
  • The policy is applied to a user group of resources of the type iosprocess (translated into English: a group of IOS processes).
  • The only process in this group is the IP Input process (and the "magic keyword" is an instance of the group).

The quotes in the instance configuration command are required, as the command accepts only a single word as the process name.


  1. Hi Ivan

    Thanks for this

    How do I trip this to test that it is actually working and being reported correctly?
  2. Flood the router with UDP packets :) More in an upcoming post.
Add comment