性能超限问题（约30分钟）USG6000E, USG6000, USG9500, NGFW Module V500, V600

1

查看业务板CPU使用率：

1. 执行命令display health，检查各业务板SPU-CPUX的CPU使用率，如果CPU使用率超过80%，需要确认是否有异常流量。

    HRP_M<sysname> display health
     Slot                CPU Usage  Memory Usage(Used/Total)
    ------------------------------------------------------------
     5 MPU(Master)          6%         52%    894MB/1712MB 
     1 SPU-CPU0             100%       35%   5517MB/15703MB
     1 SPU-CPU1             98%        34%   5471MB/15703MB
     1 SPU-CPU2             99%        27%   4277MB/15703MB
     1 SPU-CPU3             100%       27%   4282MB/15703MB
     1 SPU-CPU6             100%       16%     56MB/338MB  
     2 LPU                  20%        22%    468MB/2098MB 
    ------------------------------------------------------------
    SPU CPU Average Utilization: 1 %

2. 执行命令display firewall topn source-ip 或display firewall topn destination-ip，排查异常流量源头，并和客户确认是否属于正常业务流。

   举例：

   # 假设当前某个服务器1.1.1.1受到攻击，可以通过查看目的地址为1.1.1.1的源IP地址的排序结果确定攻击源。

   HRP_M[sysname] display firewall topn source-ip traffic all-systems destination ip-address 1.1.1.1
    Statistic result is being generated. Please wait patiently! 
    ------------------------------------------------------------------------------ 
    Top N traffic rate (last 10 seconds) 
    Ranking    IP address          Traffic rate(kb/s)    VSYS
    1          192.168.1.1         88000                 public 
    2          192.168.1.2         10380                 public 
    3          192.168.1.3         7750                  public
    4          192.168.1.4         6610                  public
    5          192.168.1.5         6010                  public
    6          192.168.1.6         4660                  public
    7          192.168.1.7         4310                  public 
    8          192.168.1.8         3790                  public
    9          192.168.1.9         3470                  public
    10         192.168.1.10        2600                  public
    ----------------------------------------------------------

   # 查看TopN会话源IP地址的排序结果，找到会话数最多的源IP并采取相应的防范措施。

   HRP_M[sysname] display firewall topn source-ip session-number
    Statistic result is being generated. Please wait patiently! 
   ------------------------------------------------------------------------------ 
    Top N Session number (source IP)
    Ranking    IP address          Session number    VSYS  
    1          192.168.1.1         8800             public 
    2          192.168.1.2         1038             public  
    3          192.168.1.3         775              public  
    4          192.168.1.4         661              public    
    5          192.168.1.5         601              public 
    6          192.168.1.6         466              public    
    7          192.168.1.7         431              public 
    8          192.168.1.8         379              public 
    9          192.168.1.9         347              public
    10         192.168.1.10        260              public 
    ------------------------------------------------------------------------------

   # 查看TopN会话目的IP地址的排序结果，找到会话数最多的目的IP并采取相应的防范措施。

   HRP_M[sysname] display firewall topn destination-ip session-number
    Statistic result is being generated. Please wait patiently! 
   ------------------------------------------------------------------------------ 
    Top N Session number (destination IP)    
    Ranking    IP address          Session number    VSYS  
    1          192.168.1.1         8800             public
    2          192.168.1.2         1038             public
    3          192.168.1.3         775              public
    4          192.168.1.4         661              public
    5          192.168.1.5         601              public
    6          192.168.1.6         466              public
    7          192.168.1.7         431              public
    8          192.168.1.8         379              public
    9          192.168.1.9         347              public
    10         192.168.1.10        260              public
    -----------------------------------------------------------