Re: Address FLap problem on c2900XL switch

jcoull · ‎07-14-2004

We constantly get this message. The flaps seem to be between various ports and port 1. What I cannot find out is what is port 1????? The port numbers do not relate to interfaces, e.g. int fas 0/1 is port13, fas0/2 is port 14 and so on. So anyone know what port 1 is??

We have no possible spanning loops in the network (that we know of).

Jul 14 11:18:40: %RTD-1-ADDR_FLAP: FastEthernet0/2 relearning 6 addrs per min

milan.kulik · ‎07-14-2004

Hi,

the port numbers you mentioned are port indexes (see http://www.cisco.com/pcgi-bin/Support/Mibbrowser/unity.pl?f=Translate&o=c2900PortIfIndex&t=yes&st=2#oid).

You can use sh spanning-tree command to see which index belongs to which port, e.g.

The error message explanation from TAC Output Interpreter:

%RTD-1-ADDR_FLAP (x1) [chars] relearning [dec] addrs per min

Explanation: Normally, MAC addresses are learned once on a port.Occasionally,

when a switched network reconfigures, due to either manualor STP reconfiguration,

addresses learned on one port are relearned on a different port. However, if there

is a port anywhere in the switched domain that is looped back to itself, addresses

will jump back and forth between the real port and the port that is in the path

to the looped back port. In this message, [chars] is the interface, and [dec] is

the number of addresses being learnt.

Recommended Action: Determine the real path (port) to the MAC address. Use the

debug ethernet-controller addr command to see the alternate path-port on which

the address is being learned. Go to the switch attached to that port. Note that

the show cdp neighbors command is useful in determining the next switch. Repeat

this procedureu until the port is found that is receiving what it is transmitting,

and remove that port from the network.

So there is probably a loop in your network...

How does the error message look which mentioned the port1?

Regards,

Milan

jcoull · ‎07-14-2004

Thankyuo for the response.

I have read the info on CCO regards the addr_flap. The confusing thing is the flapping addresses are to and from port 1. The spanning-tree command does not show what interface port 1 is. Ports 13 - 37 are associated wih fas 0/1 - 0/24. I am trying to find out what interface is associated with port 1. We do have a router attached that is running bridging to allow DLSW connectivty but I cnnot see any other physical connections that could cause loops.

milan.kulik · ‎07-14-2004

Hi,

I tried snmpwalk on my 3548 and found there are two types of interface indexes:

interfaces.ifTable.ifEntry.ifDescr.1 : DISPLAY STRING- (ascii): VLAN1

interfaces.ifTable.ifEntry.ifDescr.2 : DISPLAY STRING- (ascii): FastEthernet0/1

and

dot1dBridge.dot1dBase.dot1dBasePortTable.dot1dBasePortEntry.dot1dBasePort.13 : INTEGER: 13

dot1dBridge.dot1dBase.dot1dBasePortTable.dot1dBasePortEntry.dot1dBasePort.14 : INTEGER: 14

So it seems port1 might be int VLAN1 (management).

Here is a CCO document which might explain it a little:

http://www.cisco.com/warp/public/477/SNMP/snmp_ifIndex40700.pdf

Can you paste the error message talking about the address flapping between port1 and other port?

Regards,

Milan

jcoull · ‎07-14-2004

Thanks again. As requested here is an extract from the log on the switch. If I do a show mac add on some of thee MACs when they flap to port 1, they often show as being on interface fas 0/2 , the port to which the bridging router is attached. However, fas 0/2 reports as being port 13, not port1.

Jul 14 15:38:38: 00b0.d05f.ebda has moved from port 1 to port 10 in vlan 1

Jul 14 15:38:40: Add address 0006.5b10.3722, on port 1

Jul 14 15:38:40: 0006.5b10.3722 has moved from port 25 to port 1 in vlan 1

Jul 14 15:38:40: Add address 0006.5b10.3722, on port 1 vlan 1

Jul 14 15:38:40: 0006.5b10.3722 has moved from port 25 to port 1 in vlan 1

Jul 14 15:38:50: Add address 0006.5b10.3719, on port 14

Jul 14 15:38:50: Add address 0006.5b10.3719, on port 14 vlan 1

Jul 14 15:39:00: Add address 0006.5b10.3571, on port 25

Jul 14 15:39:00: 0006.5b10.3571 has moved from port 1 to port 25 in vlan 1

Jul 14 15:39:00: Add address 0006.5b10.3571, on port 25 vlan 1

Jul 14 15:39:00: 0006.5b10.3571 has moved from port 1 to port 25 in vlan 1

Jul 14 15:39:00: Delete address 0002.a58c.1460, on port 25

Jul 14 15:39:00: Delete address 0002.a58c.1460, on port 25 vlan 1

Jul 14 15:39:10: Add address 0006.5b10.3708, on port 14

Jul 14 15:39:10: Add address 0006.5b10.3708, on port 14 vlan 1

Jul 14 15:39:25: Add address 0006.5b10.3722, on port 25

Jul 14 15:39:25: 0006.5b10.3722 has moved from port 1 to port 25 in vlan 1

Jul 14 15:39:25: Add address 0006.5b10.3722, on port 25 vlan 1

Jul 14 15:39:25: 0006.5b10.3722 has moved from port 1 to port 25 in vlan 1

milan.kulik · ‎07-15-2004

Aren't you using something special in your network?

VMPS, URT, port security or something like that?

I've never seen such a syslog message, too.

Regards,

Milan