Getting Invalid source Mac address error

murugananthamamir · ‎07-16-2013

Dear Folkz,

I'm getting the below error in my 4507 switch. What could be the reason? plz help to prevent such kind of error !!!

core_sw01#show logging | in C4K_L2MAN-6-

005220: *Jul 11 03:34:31.080: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 54713 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Te5/5 in vlan 48

005256: *Jul 11 09:34:31.119: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 149921 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Te5/2 in vlan 117

005293: *Jul 11 15:34:31.605: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 70684 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Te5/5 in vlan 48

005330: *Jul 11 21:34:31.663: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 11017 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Te5/2 in vlan 117

005367: *Jul 12 03:34:31.718: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 84638 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Te5/4 in vlan 114

005396: *Jul 12 09:34:32.395: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 93117 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Te5/5 in vlan 48

005397: *Jul 12 19:20:05.316: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 24438 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Te5/1 in vlan 103

005398: *Jul 13 01:20:05.330: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 97297 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Te5/4 in vlan 114

005399: *Jul 13 07:20:14.930: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 77506 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Gi1/30 in vlan 103

005400: *Jul 13 14:18:30.328: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 138 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Te5/5 in vlan 121

005401: *Jul 14 03:08:30.937: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 1116 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Te5/5 in vlan 48

005402: *Jul 14 09:08:31.462: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 67942 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Te5/2 in vlan 117

005403: *Jul 14 19:37:44.679: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 14372 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Te5/5 in vlan 48

005404: *Jul 15 01:37:45.243: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 21154 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Te5/5 in vlan 48

005405: *Jul 15 07:37:46.537: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 56903 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Te5/5 in vlan 48

005406: *Jul 15 13:37:46.598: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 170472 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Te5/5 in vlan 48

005407: *Jul 15 19:38:02.558: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 54598 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Gi1/31 in vlan 116

InayathUlla Sharieff · ‎07-16-2013

The "%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET:" error message appears in Catalyst 4500 series switches running Cisco IOS software

VERSION 3

Core issue

The default form of error message is:

%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: Packet received with invalid source MAC address ([mac-addr] ) on port [char] in vlan [dec]

This means a packet was received with an all zero (00:00:00:00:00:00) or a multicast source address, for example, FF:FF:FF:FF:FF:FF. which is a Layer 2 broadcast. The packet is treated as invalid and no learning is done. Excessive flow of such packets can waste CPU cycles. This message is rate-limited and is displayed only for the first such packet received on any interface or VLAN. Subsequent messages display the cumulative count of all such packets received in given interval on all interfaces.

Resolution

Check the switch configuration file in order to find the source of these packets on the specified port and take corrective action in order to fix them at the source end. For example, it can be due to a faulty NIC or connected hub. You can also setup a SPAN session to identify the source.

Alternatively, you can also issue the switchport port-security limit rate invalid-source-mac command in order to enable port security on that interface in order to shutdown the port if the incoming rate of packets with invalid source mac address is too high.

Refer to these articles for more information: