Once on a single Cisco 6509e switch configured as L3 and with a standard CPU load of 10%, the load suddenly increased to 40%.
This did not affect the network operation, there were no errors and other packet losses, I connected to the switch and looked at the list of processes:
show processes cpu sorted | ex 0.00
sh proc cpu sorted 1
show processes memory
sh proc cpu hist
In the top was the “Net Input” process, it just loaded the CPU.
Due to the fact that I initially created templates in Zabbix and not only traffic graphics were drawn for all ports, but also Broadcast packets, Multicast and with errors.
On one of the ports, I noticed that Multicast traffic increased by about 3000 packets per second, the GPON OLT of Huawei MA5683t was connected to this port, on which I tracked the graphs of the client from which this Multicast traffic was going, I described in more detail in the article:
How to catch flood on Huawei MA5600
I just blocked this client, Multicast traffic decreased to the previous one and the CPU load returned to the standard 10%.
See also my articles:
Online diagnostics Cisco Catalyst 6500
High CPU load on Cisco Nexus 3064
SNMP OID and MIB for interfaces