Invalid mac address

[Anuj Singhi]

I am getting following logs in my core switch. Invalid mac addres and its coming from different ports and yes it can't be traced.

Mar  5 15:04:16.732 UTC: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: Packet receive                                                             d with invalid source MAC address (00:00:00:00:00:00) on port Gi2/46 in vlan 172
Mar  5 22:25:45.365 UTC: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: Packet receive                                                             d with invalid source MAC address (00:00:00:00:00:00) on port Gi2/46 in vlan 172
Mar  6 10:57:30.800 UTC: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: Packet receive                                                             d with invalid source MAC address (00:00:00:00:00:00) on port Gi2/46 in vlan 172
Mar  7 14:27:43.492 UTC: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 2                                                              times)Packet received with invalid source MAC address (00:00:00:00:00:00) on por                                                             t Gi2/46 in vlan 172
Mar  8 06:18:32.307 UTC: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 1                                                              times)Packet received with invalid source MAC address (00:00:00:00:00:00) on por                                                             t Gi2/46 in vlan 172
Mar  9 10:44:04.048 UTC: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: Packet receive                                                             d with invalid source MAC address (00:00:00:00:00:00) on port Gi2/46 in vlan 172
Mar  9 20:11:42.465 UTC: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: Packet receive                                                             d with invalid source MAC address (00:00:00:00:00:00) on port Gi2/46 in vlan 172
Mar 10 09:52:46.516 UTC: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 4                                                              times)Packet received with invalid source MAC address (00:00:00:00:00:00) on por                                                             t Gi3/10 in vlan 172
Mar 10 16:00:34.852 UTC: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 1                                                              times)Packet received with invalid source MAC address (00:00:00:00:00:00) on por                                                             t Gi3/12 in vlan 172
Mar 11 09:27:17.498 UTC: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 3                                                              times)Packet received with invalid source MAC address (00:00:00:00:00:00) on por                                                             t Gi3/10 in vlan 172

Vlan 172 have many subnets associated with it and its client vlan.

[Jose Solano]

Hi,

See this:

Core issue

The default form of error message is:

%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: Packet received with invalid source MAC address ([mac-addr] ) on port [char] in vlan [dec]

This means a packet was received with an all zero (00:00:00:00:00:00) or a multicast source address, for example, FF:FF:FF:FF:FF:FF. which is a Layer 2 broadcast. The packet is treated as invalid and no learning is done. Excessive flow of such packets can waste CPU cycles. This message is rate-limited and is displayed only for the first such packet received on any interface or VLAN. Subsequent messages display the cumulative count of all such packets received in given interval on all interfaces.

Resolution

Check the switch configuration file in order to find the source of these packets on the specified port and take corrective action in order to fix them at the source end. For example, it can be due to a faulty NIC or connected hub. You can also setup a SPAN session to identify the source.

Alternatively,  you can also issue the switchport port-security limit rate invalid-source-mac command in order to enable port security on that interface in order to shutdown the port if the incoming rate of packets with invalid source mac address is too high.

https://supportforums.cisco.com/document/21056/c4kl2man-6-invalidsourceaddresspacket-error-message-appears-catalyst-4500-series

Hope this helps.

[subhojithalder198]

HI,

45xx Switch with cat4500-ipbasek9-mz.122-50.SG3.bin IOS & same is having bug for this kind of error message.

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCto67828

We can take following action to resolve the issue

On 4k, we can disable logging regarding this event (It actually tell switch to drop frame on ASIC level instead of CPU) with following command "mac address-table static 0.0.0.0 vlan 172 drop"  this command is available since IOS 12.2(53) SG7 and later

In that case, drop will be done on Hardware rather that software( currently dropping done in Software which is also increasing CPU Utilization)

Br/Subhojit

Pls rate if useful