Kind of a head scratcher issue with ARP

[Mike 1]

Looking at the command Show Mac address accounting on a 3925, I see a particular Mac address that I'm interested in.
The Mac address is taking hits on the the counter so it's passing packets.
I don't see the associated Mac address in the Arp table.
Googling turns up 0 hits for a vendor associated with that mac address.
It's not a virtual mac. Has anyone seen this type of issue?

DCCRTR01#sh int g0/0 mac-accounting | i 1078
1078.8063.78b0(67 ): 40 packets, 1600 bytes, last: 12508ms ago
DCCRTR01#sh arp | i 1078.8063.78b0

thanks,

Mike

[balaji.bandi]

can you post the version of the code running, what happends when you issue  clear the ARP ?

[Mike 1]

c3900-universalk9-mz.SPA.151-4.M10.bin We hope to get permission next week to upgrade the OS.

The ARP table repopulates after clearing.

[Leo Laohoo]

Mike,
Track the MAC address down to the wire. Someone probably has enabled MAC address spoofing.

[Mike 1]

Thanks. I think my colleague did that but it didn't lead to an IP address. 

[Richard Burts]

I agree with my colleague @Leo Laohoo that you should use show mac address table for that mac and track the mac to the interface where it is connected. When you find the interface then identify what is connected. I am guessing that whatever is connected there is sending layer 2 frames that are not IP packets. And so there is no arp entry.