Hi,
I would like to suggest the following points.
1. need to check if your STP is stable and converging fine, how to check this, run the command, show spanning-tree bridge on all the switches in your network, check if the Root ID seen on the output is same on all the devices.
If the Root ID is same then it means all the switches sees one switch as the root bridge, and we can say the STP is converging.
2. When the issue is happening, you need to run the command, show chassis routing-engine, this will give you the status of the CPU, run this command when the issue is not seen too, and attach the outputs.
3. If possible please collect the output of top from the shell mode, during the stable time and when the issue is occuring.
This shall confirm which particular process is causing the spike.
5. Further as mentioned, you can run the following command "monitor interface traffic"
This shall list all interfaces on the switch or the VC, along with the ratio of incoming and outgoing packets on each link.
user@switch> monitor interface traffic
switch Seconds: 7 Time: 16:04:37
Interface Link Input packets (pps) Output packets (pps)
ge-0/0/0 Up 8907 (2560) 0 (99996)
ge-0/0/1 Up 392187 (99999) 392170 (0)
ge-0/0/2 Down 0 (0) 0 (0)
Please refer to this exibit carefully.
we have the ports with the (link) state with the cummulative (input packets) counter with the (pps) (curent packets coming in to the switch per second) counter.
On the above exibit we see that the pps counter on the ge-0/0/1 interface shows a very high value, when compared to ge-0/0/0 which shows 2560 pps, so this means some excessive traffic is coming in on this interface.
You can also see a flooding pattern in this, we see 99999 incoming on ge-0/0/1 and 99996 outgoing on the ge-0/0/0 interface.
This means we are receiving the traffic and flooding it.
I can tell that, you would see this behavior and the high incoming traffic to this destribution switch should be from an trunk port, which connects to the bottom switches.
you need to log in to that switch and run the same command, and you would find an interface on which the high pps incoming would be seen.
This should be an access port, block that port and your issue shall be fixed.
Then you need to investigate as to why the server or the device on that port was sending too much of traffic and you fix it, your network shall be stable again.
Thanks,
Ramesh.G