02-28-2012 06:53 AM - edited 03-07-2019 05:14 AM
feb 19 23:35:16.052 CET: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 17 times)Packet received with invalid source MAC address (09:23:3C:00:00:00) on port Gi3/15 in vlan 80
feb 20 23:35:28.923 CET: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 26 times)Packet received with invalid source MAC address (0D:1B:3B:00:00:00) on port Gi3/15 in vlan 80
feb 21 23:35:44.296 CET: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 33 times)Packet received with invalid source MAC address (9D:43:39:00:00:00) on port Gi3/15 in vlan 80
feb 22 23:35:52.990 CET: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 27 times)Packet received with invalid source MAC address (4D:4C:37:00:00:00) on port Gi3/15 in vlan 80
feb 23 23:36:25.716 CET: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 14 times)Packet received with invalid source MAC address (07:16:3B:00:00:00) on port Gi3/15 in vlan 80
feb 24 23:38:31.331 CET: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 23 times)Packet received with invalid source MAC address (07:E1:31:00:00:00) on port Gi3/15 in vlan 80
feb 25 23:37:15.222 CET: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 24 times)Packet received with invalid source MAC address (07:E1:31:00:00:00) on port Gi3/15 in vlan 80
feb 26 23:36:58.742 CET: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 26 times)Packet received with invalid source MAC address (09:1D:3B:00:00:00) on port Gi3/15 in vlan 80
feb 27 23:39:18.649 CET: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 15 times)Packet received with invalid source MAC address (07:E1:31:00:00:00) on port Gi3/15 in vlan 80
02-28-2012 07:59 AM
Hi Makarand,
All these MAC addresses are multicast (i.e. group) MAC addresses, and therefore should never be used as a source MAC. Obviously, some device on your VLAN 80 is generating frames with a malformed source MAC address. Sadly, there is no easy way to find out where that device is located - you will only have to follow the indication about physical ports where this invalid MAC addresses was detected. In your case, it is Gi3/5.
Best regards,
Peter
02-28-2012 12:42 PM
Juuuuuuuuust curious, how did you know they were an multicast address? I searched for one MAC and its coming up with nothing. We are just starting multicast in my ccnp study.
02-28-2012 01:38 PM
Hi Jimmy,
how did you know they were an multicast address
By their first octet - it is an odd number. Recall that the first octet of a MAC address has two special reserved bits. The least significant bit is the I/G (Individual/Group) bit. If set to 1, making the first octet an odd number, the MAC address is a group MAC address. If you have a close look at the first octet of all these MAC addresses: 0x09, 0x0D, 0x9D, 0x4D, 0x07, the lowest bit is always set to 1. That makes the MAC address to be a group, or multicast, address.
Just for the sake of completeness, the second reserved bit I spoke about is the second least significant bit of the first octet, and is termed as the U/L bit (Universal/Local). All officially assigned MAC address OUIs have the U/L bit set to 0. Setting the U/L bit to 1 should indicate that the particular MAC address is not officially registered and instead it has been generated unofficially (a private MAC address if you'd like).
Best regards,
Peter
02-28-2012 08:11 PM
Thank you, researched your answer, you as usual, are always correct and equally as usual, informative.
http://en.wikipedia.org/wiki/Organizationally_unique_identifier
The OUI is normally discussed and represented as a set of octets in hexadecimal notation separated by dashes (i.e., FF-FF-FF) or as a set of octets separated by colons in bit-reversed notation (i.e., FF:FF:FF).[1]
The two least-significant-bits of the second nibble of the first octet of the hexadecimal representation (i.e., the two least significant bits of the first octet) of the OUI are reserved as flag bits for some protocols (e.g., 'M' bit and 'X' bit), flags to indicate whether the address is part of an individual (unicast) or group (multicast) address block (e.g., Individual / Group [I / G] bit or Unicast / Multicast [U / M] bit), flags to indicate whether an address is universally or locally administered (e.g., Universal / Local [U / L] bit), etc., and should not contain the values 1,2,3,5,6,7,9,a, b,d, e, or f, unless these values reflect the true meaning of these flag bits – if the organization that owns the OUI does set one of these bits when creating an identifier, then the value of the second nibble of the first octet changes accordingly in representations of the OUI (e.g., if the hexadecimal value of the second nibble of the first octet is 'C' and the least-significant-bit is set, then the value becomes 'D').
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide