Impossible MAC Flap

[mriksman]

I am getting a MAC Flap every ~15 seconds.

But reviewing the network layout, it's physically impossible for this to happen.

What could be causing this?!

[marce1000]

 - Depends, the mac address could for instance network or 'cluster redundancy' for 2 similar devices on the different ports.

 M.

[mriksman]

We have nothing fancy like that....

[marce1000]

          - Scrutinize the network settings/adapters/mac-addresses from the involved devices in detail.

 M.

[Leo Laohoo]

Is this the only MAC address causing the issue? 

What is the client?  
What is connected to Fa0/4?
What is connected to Fa0/5?

[mriksman]

At the moment, yes. But I have seen other MAC addresses flap over to fa0/5.

The one in RED is not located in the same physical location. It is 57kms away connected over a series of switches, eventually entering the Cisco switch on port Fa0/4.

So how can the Cisco switch think it is appearing on Fa0/5? It is PHYSICALLY not possible.

Every few seconds, show mac address-table address 0009.0bf0.56b8 is showing the port is on Fa0/4 then on Fa0/5.

So what else can cause Cisco to say 'MAC Flap'? How could a device 'appear' on another port there is no way it could be on?

[Leo Laohoo]

I think you need to go to the site and visually inspect the path.  I suspect someone has put an un-managed switch there without you knowing.  

Another thing, how many MAC address can be seen from Fa 0/5 (sh mac address interface Fa0/5)?

[mriksman]

There is an unmanaged switch there. 57kms away. Physically not possible to get on to Fa0/5.

[Leo Laohoo]

Well, if you are saying both Fa0/4 and Fa0/5 is connected to a downstream client (and not an un-managed switch or a hub) then the output to the command "sh mac address interface Fa0/4" and "sh mac address interface Fa0/5" should be short.  

[mriksman]

This is Fa0/5. It is connected to LAN0 of a Wi-MAX station, which then communicates to a Wi-MAX AP. The one in RED is the one flapping. It is physically located 57kms away, over 4 Hirschmann switches connected via fiber optic links.

Fa0/4 is connected to a HUGE number of devices via several Hirschmann switches and fiber optic links to locations many kilometers away.

My point is. There is absolutely no way something is bridging/linked between Fa0/4 and Fa0/5. I've checked. Absolutely impossible.

[Leo Laohoo]

Ok, so what is the output to the command "sh mac add interface F0/4"?

[mriksman]

SACRL201#sh mac add interface F0/4
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
 195    0009.0bf0.44a2    DYNAMIC     Fa0/4
 195    0009.0bf0.44a4    DYNAMIC     Fa0/4
 195    0009.0bf0.56b8    DYNAMIC     Fa0/4
 195    0009.0bf0.58f4    DYNAMIC     Fa0/4
 195    0009.0bf0.591a    DYNAMIC     Fa0/4
 195    0009.9100.ef7a    DYNAMIC     Fa0/4
 195    0009.9100.ef7d    DYNAMIC     Fa0/4
 195    0009.9101.138a    DYNAMIC     Fa0/4
 195    0009.9101.6579    DYNAMIC     Fa0/4
 195    0009.9101.65af    DYNAMIC     Fa0/4
 195    0009.9101.cee0    DYNAMIC     Fa0/4
 195    0009.9102.097c    DYNAMIC     Fa0/4
 195    0009.9102.347f    DYNAMIC     Fa0/4
 195    0009.9102.3480    DYNAMIC     Fa0/4
 195    0009.9102.3481    DYNAMIC     Fa0/4
 195    0009.9102.3482    DYNAMIC     Fa0/4
 195    0009.9102.3bc6    DYNAMIC     Fa0/4
 195    0009.9103.a78a    DYNAMIC     Fa0/4
 195    0009.9103.a78b    DYNAMIC     Fa0/4
 195    0009.9104.90e5    DYNAMIC     Fa0/4
 195    0009.9107.6e64    DYNAMIC     Fa0/4
 195    0009.9107.6e69    DYNAMIC     Fa0/4
 195    0009.9140.c856    DYNAMIC     Fa0/4
 195    0009.9140.c861    DYNAMIC     Fa0/4
 195    0009.9140.cebb    DYNAMIC     Fa0/4
 195    0009.9140.db36    DYNAMIC     Fa0/4
 195    0009.9140.db46    DYNAMIC     Fa0/4
 195    0009.9140.dca9    DYNAMIC     Fa0/4
 195    0009.9140.dda1    DYNAMIC     Fa0/4
 195    0009.9140.dda2    DYNAMIC     Fa0/4
 195    0009.9140.ddb3    DYNAMIC     Fa0/4
 195    0009.9140.ddbb    DYNAMIC     Fa0/4
 195    0009.9141.4375    DYNAMIC     Fa0/4
 195    0009.9141.5c10    DYNAMIC     Fa0/4
 195    0009.9141.5c26    DYNAMIC     Fa0/4
 195    0009.9141.6b57    DYNAMIC     Fa0/4
 195    0009.9141.86d8    DYNAMIC     Fa0/4
 195    0009.9141.86e4    DYNAMIC     Fa0/4
 195    0009.9144.56cc    DYNAMIC     Fa0/4
 195    0009.9144.56fb    DYNAMIC     Fa0/4
 195    0009.9144.5753    DYNAMIC     Fa0/4
 195    0009.9144.5778    DYNAMIC     Fa0/4
 195    000d.8d01.bf68    DYNAMIC     Fa0/4
 195    000d.8d01.d8ba    DYNAMIC     Fa0/4
 195    000d.8d01.d8c2    DYNAMIC     Fa0/4
 195    000d.8d01.d8c6    DYNAMIC     Fa0/4
 195    000f.fede.8825    DYNAMIC     Fa0/4
 195    0011.322f.ee90    DYNAMIC     Fa0/4
 195    0013.21b0.8fbe    DYNAMIC     Fa0/4
 195    001d.7f00.07e7    DYNAMIC     Fa0/4
 195    0020.4a06.6548    DYNAMIC     Fa0/4
 195    0020.4a06.657a    DYNAMIC     Fa0/4
 195    0020.4a06.bde7    DYNAMIC     Fa0/4
 195    0020.4a06.c08f    DYNAMIC     Fa0/4
 195    0020.4a06.c85b    DYNAMIC     Fa0/4
 195    0020.4a06.c982    DYNAMIC     Fa0/4
 195    0020.4a09.fa1f    DYNAMIC     Fa0/4
 195    0020.4a09.fa27    DYNAMIC     Fa0/4
 195    0020.4a09.faae    DYNAMIC     Fa0/4
 195    0020.4a09.fb58    DYNAMIC     Fa0/4
 195    0020.4a0a.1ce8    DYNAMIC     Fa0/4
 195    0020.4a34.29dc    DYNAMIC     Fa0/4
 195    0020.4a34.29e1    DYNAMIC     Fa0/4
 195    0020.4a34.754d    DYNAMIC     Fa0/4
 195    0020.4a34.7603    DYNAMIC     Fa0/4
 195    0020.4a69.ee85    DYNAMIC     Fa0/4
 195    0020.4a69.eea1    DYNAMIC     Fa0/4
 195    0080.6306.3ffd    DYNAMIC     Fa0/4
 195    0080.6306.4018    DYNAMIC     Fa0/4
 195    0080.6306.404e    DYNAMIC     Fa0/4
 195    0080.6306.4069    DYNAMIC     Fa0/4
 195    0080.6306.4084    DYNAMIC     Fa0/4
 195    0080.6306.45ad    DYNAMIC     Fa0/4
 195    0080.6306.45b7    DYNAMIC     Fa0/4
 195    0080.6306.45c1    DYNAMIC     Fa0/4
 195    0080.6319.5ed8    DYNAMIC     Fa0/4
 195    0080.6348.c3d8    DYNAMIC     Fa0/4
 195    0080.6368.f13e    DYNAMIC     Fa0/4
 195    0080.6379.ff80    DYNAMIC     Fa0/4
 195    0080.6379.ffa8    DYNAMIC     Fa0/4
 195    0080.6379.ffbc    DYNAMIC     Fa0/4
 195    0080.6379.ffd0    DYNAMIC     Fa0/4
 195    0080.6386.e919    DYNAMIC     Fa0/4
 195    0090.e854.db16    DYNAMIC     Fa0/4
 195    00a0.45b3.3310    DYNAMIC     Fa0/4
 195    3c52.8268.b53b    DYNAMIC     Fa0/4
 195    3c52.8268.f7d6    DYNAMIC     Fa0/4
 195    3c52.826a.1da1    DYNAMIC     Fa0/4
 195    3c52.8271.6a5d    DYNAMIC     Fa0/4
 195    3c52.8271.6dfa    DYNAMIC     Fa0/4
 195    3c52.8274.92ae    DYNAMIC     Fa0/4
 195    509a.4c2b.ea49    DYNAMIC     Fa0/4
 195    509a.4c2b.eac7    DYNAMIC     Fa0/4
 195    509a.4c2b.ebfb    DYNAMIC     Fa0/4
 195    509a.4c2b.ec3c    DYNAMIC     Fa0/4
 195    509a.4c2c.37f9    DYNAMIC     Fa0/4
 195    509a.4c2c.389c    DYNAMIC     Fa0/4
 195    6400.6a7c.e304    DYNAMIC     Fa0/4
 195    ec74.ba0c.c8ae    DYNAMIC     Fa0/4
 195    ec74.ba11.27ad    DYNAMIC     Fa0/4
 195    ec74.ba11.27c1    DYNAMIC     Fa0/4
 195    ec74.ba3f.f785    DYNAMIC     Fa0/4
 195    ec74.baca.f40e    DYNAMIC     Fa0/4
 195    ec74.baca.f422    DYNAMIC     Fa0/4
 195    ece5.5583.d346    DYNAMIC     Fa0/4
 195    ece5.5583.d396    DYNAMIC     Fa0/4
 195    ece5.5583.d486    DYNAMIC     Fa0/4
 195    ece5.55cf.b4d6    DYNAMIC     Fa0/4
 195    f8b1.56b3.8b17    DYNAMIC     Fa0/4
 195    f8b1.56b3.b7d5    DYNAMIC     Fa0/4
Total Mac Addresses for this criterion: 110

You can see the offending MAC in this list.

If I perform the command again, seconds later, it will have disappeared.

[Leo Laohoo]

Is there another WiMAX connected to Fa0/4?

[mriksman]

Nope. Fa0/4 connects ONLY to a Hirschmann managed switch as seen in my picture above. There are no WiMAX stations on this link.

There is no physical relation between Fa0/4 and Fa0/5.

It's not the first time I've seen MAC Flapping being reported with Fa0/5. It's just never been this bad, with one MAC address, every few seconds. It's like the Ubiquiti NanoM5 hates Cisco...

[mriksman]

Hmmm... I'm trying to understand what I am seeing....

This is the one that is connected to Fa0/5. You can see the offending MAC is the only one listed as WLAN0...

What is this BRIDGE table... And why is the BRIDGE table on all of these WIMAX stations showing ALL the devices that are located on Fa0/4...?