Another network manager has reported an issue with some legacy routers. The CPU is over 80% and the SNMP engine seems to be partly responsible. The manager has turned off the SNMP engine to prevent the router from melting - but unsure why the problem has occurred.
Another network administrator has already found some information that may help. He discovered that the ARP tables on the 'busy' routers were large. In fact they were extremely large for a remote site/branch router. 50,000 entries on one of them, is some serious amount of Arp requests.
Delving further into the problem it appears that the router is proxy-arp'ing everything. Running a show arp summary (on slightly new IOS's that some of ours have) give some indication as to which interfaces the Arp'ing was being conducted. In this case it was a Vlan (the router was using an etherswitch card) that connected the remote site to its main/hub site. It was also the route for traffic that didn't have a specific route in the routing table - namely a default route (ip route 0.0.0.0 0.0.0.0 vlan128). The arp table showed requests to sites on the internet as well as internal ranges.
The Cisco documentation regarding troubleshooting high CPU utilization does cover this aspect as highlighted here:
In this case, the router generates an ARP request for each IP address that is not reachable through more specific routes, which practically means that the router generates an ARP request for almost every address on the Internet. For more information about configuring next hop address for static routing, see Specifying a Next Hop IP Address for Static Routes.ip route 0.0.0.0 0.0.0.0 Fastethernet0/0