Invalid traffic from multicast source address

[leon.sargent]

I am troubleshooting a problem on a cat 4000. receiving above error indicating that some ports on my vlan 300 are receiving frames with a multicast source address. A sniffer has confirmed the packets are coming in from the same ports reporting the addresses, but I am seeing a great deal more frames on the capture then reported in the log, does this have to do with cam entries?? I am looking for information on format of multicast mac addresses, or how to detirmine if a mac address is multicast.

I ask becuase I see log message:

%SYS-4-P2_WARN: 1/Invalid traffic from multicast source address c7:da:02:81:90:02 on port 3/32

Sho cam for this port shows

300 04-a8-08-51-7f-31 3/32 [ALL]

300 c0-66-8b-8e-8a-90 3/32 [ALL]

300 ec-7b-fa-f5-0e-2a 3/32 [ALL]

none of these mac addresses are valid for the Nic of the Unix station plugged into port 3/32, nor are they found on IEEE Standards OUI database. I wonder if the frame shows as recieved on port 3/32 becuase one of these macs in cam match the multicast address of the frame being sent?? Also anyone know how I get my Unix admin to understand that this is valid data from their machine, and not a problem with my switch???

[Richard Burts]

There is a bit in the MAC address that differentiates unicast vs multicast/braodcast frames. The first bit on the wire is the U/B bit. For Ethernet framing this is the last bit of the first byte. In the error message the first byte of the MAC was c7. If you look at c7 in binary it is 1100-0111. The 1 in the last bit indicates that this MAC is multicast or broadcast.

Multicast addresses make sense for destination addresses. They do not make sense for source addresses (how could a frame originate from a group rather than from an individual station). The switch builds the dynamic entries in the CAM by observing traffic arriving on a port and associating the source MAC address with the port on which it arrived. Since the switch regards frames in which the source MAC is multicast as invalid, it does not put those addresses into the CAM. Note that the switch can put multicast entries in the CAM based on CGMP or similar things but not as dynamic entries.

[axfalk]

I have a similar issue on my Cat-2980G, except my "multicast source addresses" are more like 61:73:5a:90:57:41 coming on the trunk ports. Where do those "bogus" MAC addresses come from?

Thanks.

[m.farrar]

I am getting these on 2980Gs, 4000s and 2900XLs with MACs like 81:00:01:01:00. They are also my coming from my trunk ports. Any ideas?

[milan.kulik]

Hi,

multicast Ethernet frame details see:

http://www.cisco.com/univercd/cc/td/doc/cisintwk/ito_doc/ipmulti.htm#xtocid10

ETHERNET MULTICAST ADDRESSES part of http://www.iana.org/assignments/ethernet-numbers

http://standards.ieee.org/getieee802/download/802.3ae-2002.pdf

Simple rule:

If the first byte in the MAC address is odd, the frame is a multicast.

Regards,

Milan

[Kevin Dorrell]

Let me see if I have this right: you have a port with one UNIX machine connected to it, but the CAM entries show that it is sourcing frames apparently from at least three different MAC addresses, and sometimes even from a multicast address.

What is the proper MAC address of the attached host? Do you see that in the CAM table for the port? You should do.

Does the host have proper network connectivity? What does the ARP cache entry look like in hosts that are talking to it?

It looks to me like it might be a faulty NIC or a faulty driver for the NIC.

The only time I have seen frames source from a multicast address was from a machine that generated them spuriously while it was booting.

Hope this helps.

Kevin Dorrell,

Luxembourg