Multicast error problem

[wkw]

Hi,

One of our Cat5513 has been displaying a lot of the error message below:

%SYS-4-P2_WARN: 8/Invalid traffic from multicast source address 01:00:5a:52:4c:4d on port 8/58

The frequency of this is quite disturbing. Any idea what this error is about? Module no.8 is our Gigabit Ethernet WS-X5410. Can that multicast address be mapped to an IP address or unicast mac-addresS? How can i go about resolving this?

thanks

woon

[pkhatri]

Hi Woon,

There is a list of multicast address fixes at this location:

http://www.cavebear.com/CaveBear/Ethernet/multicast.html

However, I don't see an assigned address prefix of 01-00-5A. What devices have you got connected to port 8/58. You might have to trace through all your switches to find out which port the offending device is connected to.

Hope that helps.

Paresh

[wkw]

Thanks for the reply Paresh. Port 8/58 is a virtual port of some kind since there are nowhere near 58 ports on any of Cisco's modules! I suspect is the backplane connecting Module no.8 to the Cat5513. Unfortunately I'm not quite sure how to go about tracing this mac-address.. show cam doesnt seem to reveal .. to go through all the switches would be near impossible since we have more than 100+ switches in our university. Yeah, the assigned address prefix of 01-00-5A is dodgy.. i was thinking of a map for those assigned address prefixes of 01-00-5e but I've never seen 5A before..I'm assuming that's the layer-2 multicast address, which means there's an equivalent layer-2 unicast address, although I do not know how to link them together

[lgijssel]

The 8/58 is most likely a reference to a port channel. Issue the show port command to verify this.

If this channel is a vlan trunk, you might still be left with quite some seaching but knowing this should limit the possible origin substantially.

It could be anything from a load balancing server farm to a network gaming protocol. Happy hunting!

Regards,

Leo

[wmoreno]

I have the same problem, but my switch is directly connected to router 7200VXR-NPEG1, with optic fiber wire.

so there is no posibility that MAC 01:00:5a:52:4c:4d came from this router because the router MAC in this interface is 001e.1426.bc1a.

so how can be this possibly? how I can stop multicast in switch / routers interfaces at the edge?

(switch 4506) - (router7200VXR-NPEG1)

look up the log:

Feb  8 05:37:56: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 4 times)Packet received with invalid source MAC address (01:00:5A:52:4C:4D) on port Gi1/2 in vlan 1

sw_4500#sh cdp ne

rtpeclo01           Gig 1/2               150             R       7206VXR   Gig 0/2

rt_7200#sh run int gi 0/2

interface GigabitEthernet0/2

ip address 10.100.2.1 255.255.255.0

media-type gbic

end

rt_7200#sh arp | in 10.100.2.1

Internet  10.100.2.1              -   001e.1426.bc1a  ARPA   GigabitEthernet0/2

sw_4500#sh run int gi 1/2

interface GigabitEthernet1/2

switchport trunk encapsulation dot1q

switchport mode trunk

end

[cadet alain]

Hi,

you get this message because this mac address has the I/G bit set so it is a group address and can never be a source address but it could be a destination address. the multicast L2 range for mapping L3 multicast is 01-00-5E  not 5A so it is

either a malformed address due to a faulty ethernet controller or someone sending forged mac addresses.

Regards

Alain

Don't forget to rate helpful posts.