SD2005 broadcasts?

[karen-schafer]

I have a Cisco SD2005 5-port switch that broadcasts (destination address: ff-ff-ff-ff-ff-ff) using a source address reserved for IEEE MAC-specific control protocols (01-80-c2-00-00-01) every second. Supposedly this IEEE reserved address is never to be used as a source address, and I believe the SD2005 is an unmanaged switch, so it shouldn't even be sending to this address as a destination. Can anybody explain this behavior?

Thank you, Karen

[David Hornstein]

Hi Karen

I took a cursory look at this problem,  but the public OUI listings contains no match for the query

01-80-c2.  Wierd

You have the option of opening a case with Cisco Small Business Support Center (SBSC),  via the URL below.  SBSC can look into the problem in a bit more depth.

I can't explain your observation, dare I suggest also have the option usually to RMA the unit via your disti partner if you have had the switch for less than 30 days,  or via Cisco, via the URL below and try a new product.

Sorry for your inconvenience..

http://www.cisco.com/en/US/support/tsd_cisco_small_business_support_center_contacts.html

regards Dave

[karen-schafer]

Hi, the reason there is no OUI listing is that it is a IEEE reserved MAC

address for 'slow protocols'. If you google it, you'll see (

http://standards.ieee.org/develop/regauth/grpmac/public.html). It is not an

assignable MAC range.

Thanks anyway,

Karen

On Wed, Aug 17, 2011 at 10:50 AM, dhornste <

[rocater]

Hello Karen

     I have not seen this before and wanted to look further into it. I found some information indicating that the MAC address 01-80-C2-00-00-01 is used for sending pause frames. Which might give some information about what is occuring. As David mentioned, if you would like additional assistance with this, please feel free to contact us here at the SBSC and we would be happy to look into it.

-Robert

[karen-schafer]

Thank you Robert.

I captured packets from the device without anything else attached, and I

still see the same behavior. I find it interesting - seems very broken. My

site uses a lot of Cisco gear (>500 devices ranging from wireless access

points to C6500-series switches). I've never seen a small business switch at

our site except for this one. It just surprises me. I guess I'd like to know

if this is normal behavior for them, or does it need a firmware upgrade,

need to be replaced, etc.

Thanks very much,

Karen

On Wed, Aug 17, 2011 at 3:37 PM, rocater <

[shaoquanl]

Hi, Karen,

Any new progress on this issue?  Seems all the SD2005s we have are doing the broadcasts with the source MAC 01-80-c2-00-00-01.  These broadcast packets spread to the whole L2 network and cause error on my 4006 L3 switch: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET.

Shaoquan Lin

[karen-schafer]

Hi Shaoquan,

Thank you for the feedback regarding your environment. That is how I first noticed it too - by the log messages on my catalyst 4500 switch. Based on the fact we are experiencing the same behavior from these SD2005 switches, I conclude this is 'normal' behavior for them and that my switch is not 'broken'. I have not pursued this issue with Cisco yet; however I did replace the SD2005 with another manufacturer's switch.

[shaoquanl]

Hi Karen,

Thank you.  I did open a case with Cisco but was told this was a "normal" behavior with SD2005.  I really don't believe so.  His argument was that other cisco divices are using similar address 01-80-c2-00-00-00 to send STP BDPU packets.  But they use 01-80-c2-00-00-00 as destination address with their own MAC as source address.  SD2005 broadcasts with 01-80-c2-00-00-01 as its source address without BDPU clearly is a different story.

The SD2005 is connected to a C2948g which is connected to a C3500.  I am looking for a way to configure those switches to block the broadcast packets with source address 01-80-c2-00-00-01 and so far no luck.  I did ask the Cisco support engineer, but have not got any answer yet.

[karen-schafer]

Hi Shaoquan, I also opened a case with Cisco. I sent them trace files of the behavior and a description of what was going on (the SD2005 behavior seems to impact normal spanning-tree operation on my catalyst 4500). I'm still waiting for an answer, although I received email from them today indicating my case has been assigned to an engineer. I'll keep you posted.

[shaoquanl]

Thank you, Karen. Have a nice weekend. - Shaoquan Lin

[karen-schafer]

I spoke with Cisco tech-support today. The engineer explained to me that the SD2005 behavior was normal; e.g. that it was sending PAUSE frames in an effort to slow down the sender. I said that would be fine except the SD2005 was broadcasting (all f's destination address) and using the IEEE reserved destination address (01-80-C2-00-00-01) as its source address, which is the crux of the problem. Additionally the SD2005 broadcasts these frames every second with no other devices attached to its ports except a sniffer. We went back and forth and finally agreed to disagree; case closed (although he did offer to exchange the SD2005 for a newer model, SD2005 is end-of-life).

Karen

[shaoquanl]

Maybe they think any devices response to the broadcast with have 01-80-C2-00-00-01 as the destination address and SD2005 treats the response as a PAUSE signal and slows down. But then every switch on the LAN will receive the packet. Anyway our case is about to close too. Cisco offered us exchange or refund.