Noisy spwr0 interface?

[rpilskog]

Hello,

one of my sensors is listening to traffic using the SPAN feature on a switch, and this is probably causing trouble on the switch. Is there any history of trouble with the spwr interface, or could it just be that the spanning is not set up correctly.

The switch in question is a Catalyst 3524 running IOS 12.0(5.2)xu and the error message goes something like addr_flap [interface] relearning [x] addresses per minute.

Any clues?

Rune

[scothrel]

Are you using the connection reset feature of CISDS? If so, this is cause of your problem. As the CSIDS resets connections, it spoofs TCP RST packets for the connections at layer 2 and up. This means the MAC adddress and IP addresses appear to change to each machine being reset in turn. This causes the MAC/IP mapping in switches to flutter (flap) and can be a problem. A feature was added to the Catalyst 6000 line to disable address learning on span ports. I am unaware of the status of that feature for IOS and the Cat 3500's. I check the 3500's we use as infrastructure in our lab, but did not see the feature. I would suggest opening a case with Cisco's TAC for IOS expert help.

Scott Cothrell