02-07-2017 07:08 AM - edited 03-08-2019 09:13 AM
Hi - I am getting host flapping messages in Cisco 4506 switch logs since some time.
Is it due to STP loop or due to wireless users roaming from one AP to another ?
Please advise and help.
Feb 7 14:52:16.221: %C4K_EBM-4-HOSTFLAPPING: STANDBY:Host 5C:51:4F:EF:85:B2 in vlan 83 is moving from port Po91 to port Po92
Feb 7 14:52:21.722: %C4K_EBM-4-HOSTFLAPPING: Host 64:80:99:C4:A9:F5 in vlan 83 is moving from port Po91 to port Po92
Feb 7 14:52:24.191: %C4K_EBM-4-HOSTFLAPPING: Host 08:11:96:47:9D:34 in vlan 83 is moving from port Po92 to port Po91
Feb 7 14:52:21.695: %C4K_EBM-4-HOSTFLAPPING: STANDBY:Host 64:80:99:C4:A9:F5 in vlan 83 is moving from port Po91 to port Po92
Feb 7 14:52:24.824: %C4K_EBM-4-HOSTFLAPPING: Host 08:11:96:47:9D:34 in vlan 83 is moving from port Po91 to port Po92
Feb 7 14:52:24.200: %C4K_EBM-4-HOSTFLAPPING: STANDBY:Host 08:11:96:47:9D:34 in vlan 83 is moving from port Po92 to port Po91
Feb 7 14:52:24.895: %C4K_EBM-4-HOSTFLAPPING: STANDBY:Host 08:11:96:47:9D:34 in vlan 83 is moving from port Po91 to port Po92
Feb 7 14:52:26.841: %C4K_EBM-4-HOSTFLAPPING: Host 08:11:96:47:9D:34 in vlan 83 is moving from port Po92 to port Po91
Feb 7 14:52:26.841: %C4K_EBM-4-HOSTFLAPPING: Host 5C:51:4F:EF:85:B2 in vlan 83 is moving from port Po92 to port Po91
Feb 7 14:52:26.898: %C4K_EBM-4-HOSTFLAPPING: Host 08:11:96:47:9D:34 in vlan 83 is moving from port Po91 to port Po92
Feb 7 14:52:26.786: %C4K_EBM-4-HOSTFLAPPING: STANDBY:Host 08:11:96:47:9D:34 in vlan 83 is moving from port Po92 to port Po91
Feb 7 14:52:26.786: %C4K_EBM-4-HOSTFLAPPING: STANDBY:Host 5C:51:4F:EF:85:B2 in vlan 83 is moving from port Po92 to port Po91
Feb 7 14:52:26.992: %C4K_EBM-4-HOSTFLAPPING: STANDBY:Host 08:11:96:47:9D:34 in vlan 83 is moving from port Po91 to port Po92
Port 91 and Po2 goes to two WLCs
!
interface Port-channel91
description ** Link to WLC01 **
switchport
switchport trunk allowed vlan 80-83
switchport mode trunk
switchport nonegotiate
spanning-tree portfast trunk
interface Port-channel92
description ** Link to WLC02 **
switchport
switchport trunk allowed vlan 80-83
switchport mode trunk
switchport nonegotiate
spanning-tree portfast trunk
Switch#sh vlan id 83
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
83 WLAN_INT active Po1, Po2, Po3, Po4, Po5, Po6, Po7, Po8, Po9, Po12, Po13, Po61, Po62, Po63, Po64, Po70, Po91, Po92, Po100
Switch#sh span vlan 83
VLAN0083
20 sec Forward Delay 15 sec
Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Po1 Desg FWD 3 128.2561 P2p
Po2 Desg FWD 3 128.2562 P2p
Po3 Desg FWD 3 128.2563 P2p
Po4 Desg FWD 4 128.2564 P2p
Po5 Desg FWD 3 128.2565 P2p
Po6 Desg FWD 3 128.2566 P2p
Po7 Desg FWD 3 128.2567 P2p
Po8 Desg FWD 3 128.2568 P2p
Po9 Desg FWD 3 128.2569 P2p
Po12 Desg FWD 3 128.2572 P2p
Po13 Desg FWD 3 128.2573 P2p
Po61 Desg FWD 3 128.2621 P2p
Po62 Root FWD 3 128.2622 P2p
Po70 Desg FWD 3 128.2630 P2p
Po91 Desg FWD 3 128.2651 P2p Edge
Po92 Desg FWD 3 128.2652 P2p Edge
Po100 Desg FWD 3 128.2660 P2p
02-07-2017 07:22 AM
hi
Looks like a fairly common issue when I search the alert , same response in Cisco docs as this doc below , what is that mac address , is it a user mac or belonged to a network device ?
http://blog.qsolved.com/2011/12/c4kebm-4-hostflapping-host-86aac079aa6a_21.html
02-07-2017 07:45 AM
The 2 ports got to 2 WLCs through which wireless users connect. the 3 mac Ids I checked belonged to Intel Corp. Its a busy place and users move and roam between different APs which are connected to 2 WLC. Is it due to roaming that these logs are appearing or do you think it is a loop ?
thanks
02-07-2017 08:28 AM
if the macs are belonged to user nics its most likely them moving between ports causing it , I have seen it with 6500s using GLBP in a site before constant flapping on college core switches as user were moving between rooms every hour , you should be able to tell if you have a loop the cpu will be very high , do you see any other issues on the switches other than that if not I wouldn't be too concerned especially as its hanging off wlcs
check the spanning-tree see if your seeing constant changes for that vlan , if its not flapping every minute your ok
show spanning-tree detail | inc ieee|occurr|from|is exec
02-08-2017 03:48 AM
02-08-2017 04:07 AM
ok so there is no constant STP change occurring if that's the latest change which would indicate its a standard mac move in wireless most likely as your not seeing any changes at the vlan at layer 2 at all
the CPU the 2nd core is reporting a high iosd process , other than that it looks ok
8402 4018392 194447239 229 41.8 42.1 42.8 0 iosd
It will be easier to see the highest cpu procs with this command
Show proc cpu sorted | ex 0.00
Take a look at this link for tshooting high iosd on 4500s , sometimes it can be a bug as well if nothing else seems to fix it an upgrade might depending what version your on
https://supportforums.cisco.com/discussion/11851106/high-cpu-4500x-utilization#3970053
02-08-2017 04:16 AM
02-08-2017 04:20 AM
Ok good thats definitely causing the high cpu , its an issue with your iosd process which is an internal system process belonged to Cisco , if its causing slowness you need to look into it , that support link in the last post was provided by a TAC engineer I would follow the steps in that link to troubleshoot it, if its nothing obvious change the software version
IOSd: This is the Cisco IOS daemon that runs on the Linux kernel. It is run as a software process within the kernel.
02-08-2017 04:52 AM
thanks a lot - I'll follow up accordingly.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide