Port Security : Multiple MACs seen on single NIC

[gktang]

Port security with a single MAC has been enabled on all my switch ports. Recently, I've had some users complaining of being disconnected. I checked and found that the users' ports have all been err-disabled and the users all had 2 MAC addresses on the interface even though they have only a single NIC. This happens on different ports and different switches. The 2nd MAC disappears some times after the PC is rebooted or the switch ports are swapped but this doesn't always work and I need to increase the port security MAC maximum to 2.

Would appreciate if anyone knows why the NIC is showing 2 MACs suddenly. Thx!

[Prashanth Krishnappa]

What kind of switches are these? Also do the MAC address of the second MAC look real or made up? Do you see any errors on the physical interfaces?

[gktang]

They are all Cisco 2950 with a few IOS versions. 12.1(9)EA1, 12.1(11)EA1, 12.1(19)EA1c.

I've captured the MAC addresses and they seem real. 2 examples below.

Vlan Mac Address Type Ports

---- ----------- ---- -----

2 0002.a50d.362f STATIC Fa0/4 actual compaq

2 00d0.b70b.538d STATIC Fa0/4 intel

Vlan Mac Address Type Ports

---- ----------- ---- -----

2 000d.6004.9f65 STATIC Fa0/16 actual ibm

2 0011.2535.75a2 STATIC Fa0/16 ibm