cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
608
Views
0
Helpful
4
Replies

Multicast source address

lracano
Level 1
Level 1

I have been getting this message on my 4006 for the past week.

WK_1000/2000 2005 Dec 01 13:34:37 %SYS-4-P2_WARN: 1/Invalid traffic from multicast source address ff:ff:ff:ff:ff:ff on port 1/1

I have put a sniffer on port 1/1 which is the trunk port and nothing is sticking out to me. Does anyone know how to track down the source of this message?

Thanks

4 Replies 4

mparekh
Level 3
Level 3

Check port 1/1 for FCS errors. Also make sure that there are no duplex mismatches on the interface.

Thanks, there are no FCS errors on the port and no duplex mismatches.

This what i got as the defenition of the error:

-----------------------------------------------------

%SYS-4-P2_WARN: 1/Invalid traffic from multicast source address

Problem

The switch is generating Invalid traffic from multicast source address messages.

Description

This is an example of the syslog output that you see when this error occurs:

SYS-4-P2_WARN: 1/Invalid traffic from multicast source address

81:00:01:00:00:00 on port 2/1

%SYS-4-P2_WARN: 1/Invalid traffic from multicast source address

81:00:01:01:00:00 on port 2/1The Invalid traffic from multicast source address syslog message is generated when the switch receives packets with a multicast MAC address as the source MAC. The use of a broadcast or multicast MAC address as the source MAC for a frame is not standards-compliant behavior. However, the switch still forwards traffic sourced from a multicast MAC address.

The syslog message indicates the multicast MAC address in the source MAC field of the frame, and the port on which the traffic was received.

The workaround is to try to identify the end station that is generating frames with a multicast source MAC address. Typically, such frames are transmitted from a traffic generator (for example, SmartBits) or third-party devices that share a multicast MAC address (for example, load-balancing firewall or server products).

----------------------------------------------------

I would try to trace from port 1/1 and see what device may cause this traffic pattern. What's connected to port 1/1?

Thanks for the info...Port 1/1 is a trunk port and when I put a sniffer on it, I did not see multicast traffic from 1 specific IP.