INVALIDSOURCEADDRESSPACKET

[sridhar ch]

Hi,

%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 4 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Gi1/2 in vlan xxx. How can i troubleshoot this?

Thanks,

Sridhar

[Sandeep Choudhary]

Hi Sridhar,

Error:

%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: Packet received with invalid source MAC address ([mac-addr] ) on port [char] in vlan [dec]

This means a packet was received with an all zero (00:00:00:00:00:00) or a multicast source address, for example, FF:FF:FF:FF:FF:FF. which is a Layer 2 broadcast. The packet is treated as invalid and no learning is done. Excessive flow of such packets can waste CPU cycles. This message is rate-limited and is displayed only for the first such packet received on any interface or VLAN. Subsequent messages display the cumulative count of all such packets received in given interval on all interfaces.

Resolution

Check the switch configuration file in order to find the source of these packets on the specified port and take corrective action in order to fix them at the source end. For example, it can be due to a faulty NIC or connected hub. You can also setup a SPAN session to identify the source.

Alternatively,  you can also issue the switchport port-security limit rate invalid-source-mac command in order to enable port security on that interface in order to shutdown the port if the incoming rate of packets with invalid source mac address is too high.

Regards

Please rate if it helps.

[Arumugam Muthaiah]

Hi Sridar,

Sandeep explained well about this issue and i would like to add few more points here,

These errors are only informative and are not directly related with the switch. The important thing is to find the source of the packet or the device that is sending the packet. This indicates that a bad packet was received and was dropped. This could have been sourced as bad packet for different reasons; such as the size of Ethernet frame reported different
from expected IP packet size. The issue can be reported due to bad NIC cards, bad NIC drivers, or bad application.

This message is for informational purpose only. In older IOS versions, these packets are normally dropped without being logged.

If you are receiving a large amount of these errors you might try to track down the source device that is sending the erroneous packets, you'll need to use a network sniffer. You might also examine the adjacent Cisco device for other errors.

#show platform hardware interface gigabitEthernet 1/2 statistics
#show interfaces gigabitEthernet 1/2 counters errors
If error counters increase, it could be worth trying different physical aspects to see if something requires replacement:

- ports

- modules

- optics

- cables

Regards,

Aru

*** Please rate if the post is useful ***

[marekenn1]

I am seeing these errors also with the all -zeroes mac address:

Dec  7 09:49:21 EST: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 1423 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Gi5/48 in vlan XXX

I do not believe these packets are dropped as I see the same message on our distribution routers and other switches on the VLAN - all point back to this switch, the only one where they are coming from an access port.  I set up a monitor session and did 2 captures (total just over 20 minutes).  There were no packets which had 00:00:00:00:00:00 as a MAC address.  Wireshark showed no bad packets and show interfaces gigabitEthernet 1/2 counters errors shows no errors.

There is a NETGEAR GS108NA Prosafe Gigabit Desktop switch connected to this port with multiple devices attached. I'm not sure if actually seeing one of the bad packets would help, since it would still be difficult to associate with one of the devices attached to the NETGEAR switch, but the fact that I don't even see them is kind of frustrating.  Other reports of this error have shown different invalid MAC addresses (e.g. multicast).  Is it wrong to take that MAC reported literally in this case?