Flapping between two ports

[paulo.s]

Hi!

This problem happened few hours ago in my network.

%SYS-4-P2_WARN: 1/Host 00:05:31:df:b8:09 is flapping between port 3/46 and port 2/1

I discovered a loop in a switch layer 2 connected in my port 3/46. The port 2/1 is a trunk port, I have a Catalyst 4006 with a module RSM, I have about 25 vlans. There is another trunk port 2/2, both are connected in GigabitEthernet's RSM 3 and 4.

In this moment everything ok, but I wish to know why this happen?

Thks,

Paulo

[pkhatri]

Hi Paulo,

The following link explains why this error occurs etc:

http://www.cisco.com/warp/public/473/176.html#subtopic1k

Pls do remember to rate posts.

Paresh

[ybajpai]

By its very nature, a "loop" means packets keep circulating the network endlessly. When that happens, suppose there is a host with a MAC address 'M' that is actually 'seen' on gig 2/1. So the switch would add the mac M in its cam table and associate it with port 2/1. Things are normal so far...

now when a loop occurs, the packet sourced by that host are also circulating your network through the 'looped' port 3/46. This makes the switch 'see' the (looped) packet coming from 3/46 and it 'relearns' the MAC M on port 3/46.

So when there are a lot of cam table changed like this i.e. first learn from 2/1 then 3/46 etc...you get a syslog printed as what you got.

[paulo.s]

Ok Ybaipai, thanks for your atention.

But, what I can't understand is the mac address in conflict is the mac address for internal Catalyst's trunk port 2/1. All my vlan's default gateways are configured in my router switch module, and if I look arp's table in RSM, all have the same mac address. Ok it's correct, but why port 3/46 connected with a switch in other floor, Catalyst "seen" the same mac?

I don't know, if you understand me.

Thks again.

Paulo

[scottmac]

If this system happens to be connected to a wireless system (especially with non-Cisco APs), the wireless system may not be handing off the roaming client cleanly.

We've see this with some Symbol systems: The new AP (roamed to) takes the client, but the previous AP (roamed from) has not stopped sending traffic from that roaming client.

The switch sees the same MAC in two places and alternately shuts down the offending ports until one AP or the other finally stops the traffic.

The error gets reported as a "flap."

It's a long shot, but I figured I'd toss it in as a possibility.

Good Luck

Scott

[ybajpai]

hey Paulo,

The reasoning still remains the same. The syslog that you see is generated only when the switch see's a particular mac address onetime on port x and another time on port y changing rapidly.

This L2 ethernet frame could be user packet or a system generated frame. As long as there is some looping mechanism in your L2 network, the switch would 'see' the same packet once on the original port and another time on the looping port.

HTH,

yash

[l.mourits]

Paolo,

Do you happen to have Dell desktops in your environment?

Why I'm asking? Well, we are running into a similar problem where multiple Dell desktops seem to boot up after a power failure, all using the same particular MAC address. Since we are running DHCP all desktops get the same reservation, e.g the same IP address. The OS (Winblows) never detects an IP address conflict since the MAC address is the same. The MAC address seen is typically not the MAC address of the Ethernet Adapter. So far we narrowed it down to a BIOS related issue and will escalate to Dell to have them investigate.

Don't know if this helps you, but if it does, please post reply and let us all know, as this might be more generic in this case.

Kind regards,

Leo

[paulo.s]

Hi Leo.

No, the problem wasn't with Dell desktops. It was with a loop in switch's workgroup.

But I have Dell Servers in my network, and I will alert if the problem back.

Thks for the tip.

Paulo