CSCuu69332 - Frame with special DesMac is forwarded by STP block port

[taylorML1]

Does anyone know what the special destination mac address is that it's forwarding?

I'm pretty sure I have this going on in a 3560x but my Smart Net lapsed, and I'm trying to get it resolved.. with a work around or something but I'm looking to confirm. 

Any chance it could be something like this? "01:00:5e:7f:ff:fa" 

Thanks in advance. 

[gnijs]

My guess it is an LLDP frame with dmac 0180.c200.0003.

There is a simular bug on Nexus switches:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCux07028

and both bugs are mentioned in a Security Advisory:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-ios

[taylorML1]

Through extensive troubleshooting I was eventually able to determine that there must be a bug (this one or one similar)  in the software level I was running on the switches I had in place.  It was caused by a Xerox Printer with a fiery print controller. Something on the device was generating the packets with a mac address that was being forwarded on blocking ports.

After putting the switches back on smart net, I downloaded and installed an updated version of the software which resolved the issue. 

[lrian]

01:00:5e:7f:ff:fa is 239.255.255.250  which is Microsoft uPNP group

Your issue is most probably Windows machines with uPNP enabled.