A MAC flap is caused when a switch receives packets from two different physical/logical interfaces with the same source MAC address.
When flapping occurs it causes this table to be updated whenever a packet is sent/received. The more data flowing through the interface that is flapping the higher your CPU Utilization is going to be which can have serious potential negative side effects.
Use below command to identify high CPU issue.
Switch# show process cpu sorted
CPU utilization for five seconds: 17%/0%; one minute: 16%; five minutes: 16%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
Each of the platform-specific processes has a target or expected CPU utilization. When that process is within range, the CPU executes the process in the high-priority context and the show processes cpucommand output displays that utilization under Cat4k Mgmt HiPri. If a process exceeds the target, it runs under the low-priority context and the show processes cpucommand output counts that additional utilization under Cat4k Mgmt LoPri. You can also use Cat4k Mgmt LoPrito run background and other low-priority processes (such as consistency check and reading interface counters). This mechanism allows the CPU to run high-priority processes when necessary. The remaining idle CPU cycles are used for the low-priority processes. Marginally exceeding the target CPU utilization (or a brief utilization spike) does not reflect a problem that requires investigation.
To resolve issue use below command to generate the logs on switch for mac address flapping issue. Generally does not show mac flap logs on switch. As to avoid too many logs in switch.
*Oct 3 08:51:28.149: %SYS-5-CONFIG_I: Configured from console by admin on vty0 (10.10.10.236)
*Oct 3 09:43:46.437: %C4K_EBM-4-HOSTFLAPPING: Host 00:60:48:1B:01:15 invlan 400 is moving from port Gi2/40to port Gi2/30
*Oct 3 09:43:48.629: %C4K_EBM-4-HOSTFLAPPING: Host 00:60:48:1B:01:15 invlan 400 is moving from port Gi2/30to port Gi2/40
*Oct 3 09:43:48.717: %C4K_EBM-4-HOSTFLAPPING: Host 00:60:48:1B:01:15 invlan 400 is moving from port Gi2/40to port Gi2/30
*Oct 3 09:43:49.581: %C4K_EBM-4-HOSTFLAPPING: Host 00:60:48:1B:01:15 invlan 400 is moving from port Gi2/30to port Gi2/40
Logs shows that MAC address bouncing between two different physical ports.
1.Finally to disable one of the two interfaces or configure LACP as per requirement. It may also between two different ESXI/blade servers /firewall consisting same mac address connected on two different switches which are in common LAN segment. 2.Remove command after issue resolved. 3.cisco4500(config)#no mac address-table notification mac-move
We have two Catalyst 4500-X L3 switches, one at our primary building and one at our secondary building. We have multiple VLANs setup for each department, servers, etc, with EIGRP routing the different subnets together.When I run wireshark on any computer ...
We have 4 ip pools (one voice ip pool for VOIP and 3 data ip pools) and our dhcp server is started assigning voice ip pool address to any new laptop or desktop is connected to network.And when i check my dhcp our primary data ip pool is full and its now s...
Dear community, I have two ISP wan connections that need to terminate in a layer three switch. How can i use vlans to separate the connections terminating in the wan switch? I have i firewall that needs to be connected to this wan switch. How can i d...
For starters I'm using an IE 3010-16S-8PC switch and I am a beginner. I'm attempting to comm (remote desktop, ping, etc.) with a piece of equipment that has a set ip address of 192.168.254.11 (this cannot change.) The equipment will only comm with t...
I have two 2801 routers, when I connect them with a CAT-5 cable to each other, then show up / down. When I connect them to a switch, it shows up/up. Everything is set to auto on the interfaces. I have read some of the posts about n...