I have a ccr1072 on version 6.49.13. About 2 weeks ago it started having issues. Initially it dropped a portion of it’s ospf routes. like 3 out of 5. Then a few other times it was having a hard time passing traffic. CPU was maxed out. I then tried to lessen the load by decentralising natting to our other routers. That seemed to help to an extent but I’ve still had issues. Random reboots, occassion cpu spikes but those have lessened. Today it rebooted on me twice those. Once while trying to run the packet sniffer and once while trying to torch an interface. The cpu seems to stay consistent between 7-14 percent usage. I don’t dare run any more tests or try for a supout file. I think it would crash it again. One thing though, I noticed when I was able to torch earlier that it showed what looked to be like invalid traffic. It showed traffic from a subnet that is routed to us from our isp but those ip’s are not in use(not assigned or routed) so I’m assuming its invalid traffic. src address on torch would show 1000’s of connections from ips from this subnet and the dst address was of the ip of our gateway. It also showed 1000’s of connections with the src address of our gateway port and dst addresses of the ip within this unused subnet.
This has become quite a frustration and I don’t know if it’s faulty hardware. I’m think the answer is to replace the 1072 with a ccr2216. Any opinions on the 2216. We’ve never used it yet, just the 2116.
I’ve thought, ddos, bad hardware, incorrect config somewhere, etc. I just can’t pinpoint it and it’s so random. When it happens though it’s hard to even get into our router to check anything.