略
%Aug 29 06:04:16:488 2026 SDDOY-MA-IDC-SW14-H3CS5552 IFNET/4/IF_EGRESS_DROP:
Packet loss occurs in queue 2 of Ten-GigabitEthernet1/0/49.
%Aug 29 06:04:16:496 2026 SDDOY-MA-IDC-SW14-H3CS5552 IFNET/4/IF_BOARD_EGRESS_DROP:
Packet loss occurs on chassis 0 slot 1.
%Aug 29 06:06:17:183 2026 SDDOY-MA-IDC-SW14-H3CS5552 IFNET/4/IF_EGRESS_DROP_RECOVER:
Packet loss recovers in queue 2 of Ten-GigabitEthernet1/0/49.
%Aug 29 06:06:17:191 2026 SDDOY-MA-IDC-SW14-H3CS5552 IFNET/4/IF_BOARD_EGRESS_DROP_RECOVER:
Packet loss recovers on chassis 0 slot 1.
%Sep 2 18:28:27:265 2026 SDDOY-MA-IDC-SW14-H3CS5552 IFNET/4/IF_EGRESS_DROP:
Packet loss occurs in queue 2 of Ten-GigabitEthernet1/0/49.
%Sep 2 18:28:27:273 2026 SDDOY-MA-IDC-SW14-H3CS5552 IFNET/4/IF_BOARD_EGRESS_DROP:
Packet loss occurs on chassis 0 slot 1.
%Sep 2 18:29:27:613 2026 SDDOY-MA-IDC-SW14-H3CS5552 IFNET/4/IF_EGRESS_DROP_RECOVER:
Packet loss recovers in queue 2 of Ten-GigabitEthernet1/0/49.
%Sep 2 18:29:27:621 2026 SDDOY-MA-IDC-SW14-H3CS5552 IFNET/4/IF_BOARD_EGRESS_DROP_RECOVER:
Packet loss recovers on chassis 0 slot 1.
%Sep 1 08:59:15:359 2026 SDDOY-MA-IDC-SW14-H3CS5552 DRVPLAT/4/PORT_ATTACK_OCCUR:
Auto port-defend started. SourceAttackInterface=Ten-GigabitEthernet1/0/49, AttackProtocol=IP_ROUTE
%Sep 1 08:59:17:375 2026 SDDOY-MA-IDC-SW14-H3CS5552 DRVPLAT/4/PORT_ATTACK_OCCUR:
Auto port-defend started. SourceAttackInterface=Ten-GigabitEthernet1/0/50, AttackProtocol=IP_ROUTE
%Sep 1 08:59:44:545 2026 SDDOY-MA-IDC-SW14-H3CS5552 DRVPLAT/4/PORT_ATTACK_OCCUR:
Auto port-defend stopped. SourceAttackInterface=Ten-GigabitEthernet1/0/49, AttackProtocol=IP_ROUTE
%Sep 1 08:59:58:634 2026 SDDOY-MA-IDC-SW14-H3CS5552 DRVPLAT/4/PORT_ATTACK_OCCUR:
Auto port-defend stopped. SourceAttackInterface=Ten-GigabitEthernet1/0/50, AttackProtocol=IP_ROUTE
在Aug 29 06:04:16:488 2026和Sep 2 18:29:27:613 2026时,1/0/49端口持续拥塞,影响到整块板卡的转发性能,于是板卡级告警跟着一起报出来
入方向一般不会堵塞,一般是出方向堵塞
IP_ROUTE = 需要交换机 CPU 参与三层处理的 IP 报文。可能原因是在 Sep 1 08:59:15:359 2026 时,从1/0/49、1/0/50有大量报文上送CPU,这类报文超过阈值,交换机启动 Auto port-defend 保护自己——对该口上送 CPU 的报文限速/丢弃。
猜测:
可以看下设备的接口,除了这俩口以外,其余的口全都是down的,这两个口也是路由负载分担,所以可以怀疑是流量成环了
三层转发每经过一跳ttl会减一,减到1的时候报文就会上送cpu处理,所以触发了cpu保护
分析日志