BugZero | Cisco BugID CSCvi05172 - Overruns due to nbar with bursty flows

Loading...

Operational Defect Database

A free repository of operational (non-security) bugs centralized through custom integrations with leading IT vendors.

Product

BugZero Prevent
BugZero Plan
Operational Risk Scoring
Vendor Integrations

Company

Plans
Value Guide
About
Contact us
Legal

Resources

Blog
ServiceNow App
Trust Center
Risk Management
NIST
DORA

Operational Defect Database

A free repository of operational (non-security) bugs centralized through custom integrations with leading IT vendors.

Product

BugZero Prevent
BugZero Plan
Operational Risk Scoring
Vendor Integrations

Company

Plans
Value Guide
About
Contact us
Legal

Resources

Blog
ServiceNow App
Trust Center
Risk Management
NIST
DORA

©2025 BugZero. All Rights Reserved.

Privacy Policy Terms of Service

BugZero | Cisco BugID CSCvi05172 - Overruns due to nbar with bursty flows

ODD
Cisco
CSCvi05172

Cisco - Defect ID: CSCvi05172

Overruns due to nbar with bursty flows

ODD
Cisco
CSCvi05172

Cisco - Defect ID: CSCvi05172

Overruns due to nbar with bursty flows

Last updated on February 19th, 2026

BugZero Risk Score
6.1 Medium

Overall: 6.1

Severity: 6.4

Lifecycle: 9.1

Popularity: 5.1

What is the BugZero Risk Score?

Cisco Integration

Learn more about where this data comes from

Cisco Integration

BugZero Plan

Streamline upgrades with automated vendor bug scrubs

BugZero Plan

BugZero Prevent

Wish you caught this bug sooner? Get proactive today.

BugZero Prevent

Bug Details

Description

Symptom

A QFP based Router may experience overruns and/or high qfp utilization due to bursty flows which are processed by statful feature. e.g. NBAR

Conditions

This is seen when nbar is enabled (or is implicitly turned on by other features such as "match protocol") and bursty traffic patterns are seen. Specifically when auto-learn functionality is enabled. auto-learn functionality is used for serviceability and samples traffic. it can be safely shut down.

Workaround

configure no ip nbar classification auto-learn top-hosts

Further Problem Description

Change history

2026-02-19 Removed: Denali-16.3.6

2026-02-19 Removed: Denali-16.3.6

2023-05-10 Added: 16.6.2, Denali-16.3.6

Relevant Products

Click on a version to see all relevant bugs

Affected versions:16.6.2

Fixed versions: 16.10.1, 16.10.1a, 16.10.1b, 16.10.1c, 16.10.1d, 16.10.1e, 16.10.1f, 16.10.1g, 16.10.1i, 16.10.1s, 16.10.2, 16.10.3, 16.11.1, 16.11.1a, 16.11.1b, 16.11.1c, 16.11.1s, 16.11.2, 16.12.1, 16.12.1a, 16.12.1c, 16.12.1s, 16.12.1t, 16.12.1w, 16.12.1x, 16.12.1y, 16.12.1z, 16.12.2, 16.12.2a, 16.12.2s, 16.12.2t, 16.12.3, 16.12.3a, 16.12.3s, 16.12.4, 16.12.4a, 16.12.5, 16.12.5a, 16.12.5b, 16.6.4, 16.6.4a, 16.6.4s, 16.6.5, 16.6.5a, 16.6.5b, 16.6.6, 16.6.7, 16.6.7a, 16.6.8, 16.6.9, 16.7.2, 16.7.3, 16.7.4, 16.8.2, 16.8.3, 16.9.1, 16.9.1a, 16.9.1b, 16.9.1c, 16.9.1d, 16.9.1s, 16.9.2, 16.9.2a, 16.9.2s, 16.9.3, 16.9.3a, 16.9.3h, 16.9.3s, 16.9.4, 16.9.4c, 16.9.5, 16.9.5f, 16.9.6, 16.9.7, 17.1.1, 17.1.1a, 17.1.1s, 17.1.1t, 17.1.2, 17.1.3, 17.2.1, 17.2.1a, 17.2.1r, 17.2.1v, 17.2.2, 17.2.3, 17.3.1, 17.3.1a, 17.3.1w, 17.3.1x, 17.3.2, 17.3.2a, 17.3.3, 17.3.3a, 17.4.1, 17.4.1a, 17.4.1b, 17.5.1, 17.5.1a, 3.16.8S_BinOS, 3.16.8S_V155_3_S8_FC2, 3.16.9S_BinOS, 3.16.9S_V155_3_S9_FC3

Relevant Products

Click on a version to see all relevant bugs

Affected versions:16.6.2

Fixed versions: 16.10.1, 16.10.1a, 16.10.1b, 16.10.1c, 16.10.1d, 16.10.1e, 16.10.1f, 16.10.1g, 16.10.1i, 16.10.1s, 16.10.2, 16.10.3, 16.11.1, 16.11.1a, 16.11.1b, 16.11.1c, 16.11.1s, 16.11.2, 16.12.1, 16.12.1a, 16.12.1c, 16.12.1s, 16.12.1t, 16.12.1w, 16.12.1x, 16.12.1y, 16.12.1z, 16.12.2, 16.12.2a, 16.12.2s, 16.12.2t, 16.12.3, 16.12.3a, 16.12.3s, 16.12.4, 16.12.4a, 16.12.5, 16.12.5a, 16.12.5b, 16.6.4, 16.6.4a, 16.6.4s, 16.6.5, 16.6.5a, 16.6.5b, 16.6.6, 16.6.7, 16.6.7a, 16.6.8, 16.6.9, 16.7.2, 16.7.3, 16.7.4, 16.8.2, 16.8.3, 16.9.1, 16.9.1a, 16.9.1b, 16.9.1c, 16.9.1d, 16.9.1s, 16.9.2, 16.9.2a, 16.9.2s, 16.9.3, 16.9.3a, 16.9.3h, 16.9.3s, 16.9.4, 16.9.4c, 16.9.5, 16.9.5f, 16.9.6, 16.9.7, 17.1.1, 17.1.1a, 17.1.1s, 17.1.1t, 17.1.2, 17.1.3, 17.2.1, 17.2.1a, 17.2.1r, 17.2.1v, 17.2.2, 17.2.3, 17.3.1, 17.3.1a, 17.3.1w, 17.3.1x, 17.3.2, 17.3.2a, 17.3.3, 17.3.3a, 17.4.1, 17.4.1a, 17.4.1b, 17.5.1, 17.5.1a, 3.16.8S_BinOS, 3.16.8S_V155_3_S8_FC2, 3.16.9S_BinOS, 3.16.9S_V155_3_S9_FC3

Top Cisco Defects

9.7Defect ID: CSCvz07394
2960X Stack may observe hang/freeze of member switches or complete stack.
9.7Defect ID: CSCvm90995
ASR1000-RP2: Rommon fails to boot Cisco IOS software of 1GB size
9.7Defect ID: CSCwc94466
Cisco ASA/FTD Firepower 2100 SSL/TLS Denial of Service Vulnerability
9.7Defect ID: CSCwj45822
Cisco ASA and FTD Software Remote Access VPN Brute Force Denial of Service Vulnerability
9.7Defect ID: CSCwc80831
High CPU seen across vEdge platform

Ready to prevent the next vendor outage?

Links

Original Vendor Announcement

Cisco Integration

Learn more about where this data comes from

Cisco Integration

BugZero Plan

Streamline upgrades with automated vendor bug scrubs

BugZero Plan

BugZero Prevent

Wish you caught this bug sooner? Get proactive today.

BugZero Prevent