C4K_EBM-4-HOSTFLAPPING between ports on cisco WS-C4506-E

[Bali Khan]

Hi - I am getting host flapping messages in Cisco 4506 switch logs since some time.

Is it due to STP loop or due to wireless users roaming from one AP to another ?

Please advise and help.

Feb  7 14:52:16.221: %C4K_EBM-4-HOSTFLAPPING: STANDBY:Host 5C:51:4F:EF:85:B2 in vlan 83 is moving from port Po91 to port Po92
Feb  7 14:52:21.722: %C4K_EBM-4-HOSTFLAPPING: Host 64:80:99:C4:A9:F5 in vlan 83 is moving from port Po91 to port Po92
Feb  7 14:52:24.191: %C4K_EBM-4-HOSTFLAPPING: Host 08:11:96:47:9D:34 in vlan 83 is moving from port Po92 to port Po91
Feb  7 14:52:21.695: %C4K_EBM-4-HOSTFLAPPING: STANDBY:Host 64:80:99:C4:A9:F5 in vlan 83 is moving from port Po91 to port Po92
Feb  7 14:52:24.824: %C4K_EBM-4-HOSTFLAPPING: Host 08:11:96:47:9D:34 in vlan 83 is moving from port Po91 to port Po92
Feb  7 14:52:24.200: %C4K_EBM-4-HOSTFLAPPING: STANDBY:Host 08:11:96:47:9D:34 in vlan 83 is moving from port Po92 to port Po91
Feb  7 14:52:24.895: %C4K_EBM-4-HOSTFLAPPING: STANDBY:Host 08:11:96:47:9D:34 in vlan 83 is moving from port Po91 to port Po92
Feb  7 14:52:26.841: %C4K_EBM-4-HOSTFLAPPING: Host 08:11:96:47:9D:34 in vlan 83 is moving from port Po92 to port Po91
Feb  7 14:52:26.841: %C4K_EBM-4-HOSTFLAPPING: Host 5C:51:4F:EF:85:B2 in vlan 83 is moving from port Po92 to port Po91
Feb  7 14:52:26.898: %C4K_EBM-4-HOSTFLAPPING: Host 08:11:96:47:9D:34 in vlan 83 is moving from port Po91 to port Po92
Feb  7 14:52:26.786: %C4K_EBM-4-HOSTFLAPPING: STANDBY:Host 08:11:96:47:9D:34 in vlan 83 is moving from port Po92 to port Po91
Feb  7 14:52:26.786: %C4K_EBM-4-HOSTFLAPPING: STANDBY:Host 5C:51:4F:EF:85:B2 in vlan 83 is moving from port Po92 to port Po91
Feb  7 14:52:26.992: %C4K_EBM-4-HOSTFLAPPING: STANDBY:Host 08:11:96:47:9D:34 in vlan 83 is moving from port Po91 to port Po92

Port 91 and Po2 goes to two WLCs

!
interface Port-channel91
 description ** Link to WLC01 **
 switchport
 switchport trunk allowed vlan 80-83
 switchport mode trunk
 switchport nonegotiate
 spanning-tree portfast trunk

interface Port-channel92
 description ** Link to WLC02 **
 switchport
 switchport trunk allowed vlan 80-83
 switchport mode trunk
 switchport nonegotiate
 spanning-tree portfast trunk

Switch#sh vlan id 83

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
83   WLAN_INT                     active    Po1, Po2, Po3, Po4, Po5, Po6, Po7, Po8, Po9, Po12, Po13, Po61, Po62, Po63, Po64, Po70, Po91, Po92, Po100

Switch#sh span vlan 83

VLAN0083
  20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Po1                 Desg FWD 3         128.2561 P2p
Po2                 Desg FWD 3         128.2562 P2p
Po3                 Desg FWD 3         128.2563 P2p
Po4                 Desg FWD 4         128.2564 P2p
Po5                 Desg FWD 3         128.2565 P2p
Po6                 Desg FWD 3         128.2566 P2p
Po7                 Desg FWD 3         128.2567 P2p
Po8                 Desg FWD 3         128.2568 P2p
Po9                 Desg FWD 3         128.2569 P2p
Po12                Desg FWD 3         128.2572 P2p
Po13                Desg FWD 3         128.2573 P2p
Po61                Desg FWD 3         128.2621 P2p
Po62                Root FWD 3         128.2622 P2p
Po70                Desg FWD 3         128.2630 P2p
Po91                Desg FWD 3         128.2651 P2p Edge
Po92                Desg FWD 3         128.2652 P2p Edge
Po100               Desg FWD 3         128.2660 P2p

[Mark Malone]

hi

Looks like a fairly common issue when I search the alert , same response in Cisco docs as this doc below , what is that mac address , is it a user mac or belonged to a network device ?

http://blog.qsolved.com/2011/12/c4kebm-4-hostflapping-host-86aac079aa6a_21.html

[Bali Khan]

The 2 ports got to 2 WLCs through which wireless users connect. the 3 mac Ids I checked belonged to Intel Corp. Its a busy place and users move and roam between different APs which are connected to 2 WLC. Is it due to roaming that these logs are appearing or do you think it is a loop ?

thanks

[Mark Malone]

if the macs are belonged to user nics its most likely them moving between ports causing it , I have seen it with 6500s using GLBP in a site before constant flapping on college core switches as user were moving between rooms  every hour , you should be able to tell if you have a loop the cpu will be very high , do you see any other issues on the switches other than that if not I wouldn't be too concerned especially as its hanging off wlcs

check the spanning-tree see if your seeing constant changes for that vlan , if its not flapping every minute your ok

show spanning-tree detail | inc ieee|occurr|from|is exec 

[Bali Khan]

Thanks for your reply. The CPU is high for Core 1. I checked yesterday it was between 65 - 70 %.Any command I type, the response is little slow. So it shows something is making the switch slow. I have captured the logs in file - attached here.

please advise.

[Mark Malone]

ok so there is no constant STP change occurring if that's the latest change which would indicate its a standard mac move in wireless most likely as your not seeing any  changes at the vlan at layer 2 at all

the CPU the 2nd core is reporting a high iosd process , other than that it looks ok

8402    4018392     194447239 229    41.8 42.1 42.8 0     iosd

It will be easier to see the highest cpu procs with this command

Show proc cpu sorted | ex 0.00

Take a look at this link for tshooting high iosd on 4500s , sometimes it can be a bug as well if nothing else seems to fix it an upgrade might depending what version your on

https://supportforums.cisco.com/discussion/11851106/high-cpu-4500x-utilization#3970053

[Bali Khan]

ok that's great as far as host flapping logs are concerned. that's normal in wireless environment. thanks for your advise.

as far as cpu is concerned - attached is the file.

[Mark Malone]

Ok good thats definitely causing the high cpu , its an issue with your iosd process which is an internal system process belonged to Cisco , if its causing slowness you need to look into it , that support link in the last post was provided by a TAC engineer I would follow the steps in that link to troubleshoot it, if its nothing obvious change the software version

IOSd: This is the Cisco IOS daemon that runs on the Linux kernel. It is run as a software process within the kernel.

[Bali Khan]

thanks a lot - I'll follow up accordingly.