%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 43199 times)Packet received with invalid source MAC address (01:80:C2:00:00:01) on port Gi1/1 in vlan ...

[halima.naboulsi]

Hello,

I have this error message on my many catalysts on our network:

%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 43199 times)Packet received with invalid source MAC address (01:80:C2:00:00:01) on port Gi1/1 in vlan 501

I looked on my network, but I can't find the source of this error.

I think that is related to spanning tree, but I'm not sure.

Can anybody help me on that?

Thanks and Regards,

[cadet alain]

Hi,

01:80:C2:00:00:01 is a multicast address and it can't be a src mac address.

Regards.

[halima.naboulsi]

Hello,

Yes I know, but it is an error, and I can't find the root cause of this error.

Thanks and Regards,

[cadet alain]

Hi,

sorry. I think you must take a look at upstream switch  to start troubleshooting and you're right it has to do with STP but I can't tell you more

So I'm letting more expert people try to resolve your issue.

Regards.

Alain.

[halima.naboulsi]

Hi,

Thanks.

[Peter Paluch]

Halima,

You are looking for a misbehaving device, not for a misconfiguration here - and the only way to find the misbehaving device is to explore the network behind the Gi1/1 interface. Sniffing the traffic at various points of the network would help to narrow down the source of this traffic. You may also assume that this is a maliciously generated traffic. As you have remarked yourself, it is indeed wrong for an Ethernet frame to be sourced from a multicast MAC address. Unfortunately, it is not possible to recommend any other course of action here.

Best regards,

Peter

[bharat.rajwanshi]

This is just Flow control multicast messeges send by Cisco unmanaged Small Buisiness Switches if you have installed any in network. This Small Buisiness Switches using 802.3x mechanism to manage data flow control on network and sending PAUSE messeges on multicast address 01:80:C2:00:00:01.

B. Rajwanshi.

[Peter Paluch]

Hello Bharat,

But how can the source MAC address be set to a multicast MAC address? That is in itself a violation of Ethernet standards. The 01:80:C2:00:00:01 is a correct destination address but under no circumstances can this address be used as a source MAC. No multicast MAC address can.

Best regards,

Peter

[bharat.rajwanshi]

Hi Peter,

Yes, you are correct, this shouldn't be the case, we also faced same issue in our organization and able to confirm it causing due to Cisco SMB Switch, I also looking forward to see why this sourcing with multicast??

May Cisco developed this switch on 802.3x mech to support flow control on high speed network and used ethernet standard to achieve the same, just guessing...

Thanks!

B Rajwanshi.