Is this behaviour because of loop or normal

[trickylalit]

%C4K_EBM-4-HOSTFLAPPING: Host 3C:A9:F4:65:89:98 in vlan 1 is moving from port Te1/1/1 to port Po1
%C4K_EBM-4-HOSTFLAPPING: STANDBY:Host 3C:A9:F4:65:89:98 in vlan 1 is moving from port Te1/1/1 to port Po1

I see this messages a lot for different devices on Core Switch which is  4500 E pair in VSS.

Core Switch has following config applied:

mac address-table notification mac-move

Is this because of the configuration above all the messages are logged or some kind of loop.

I cannot think of any loop at all as you can see from diagram below

I have not checked every single Mac here but few pointed to scanners which forklift operator will be driving around across area.

SW1(Will have AP's)-Core SWITCH- SW2(Stack in portchannel and will have AP's connected to it)

Thank you.

[Leo Laohoo]

from port Te1/1/1 to port Po1

This means Te 1/1/1 should be part of the etherchannel.

[trickylalit]

Hello Leo,

SW1(2960s) connected with single MMF to Core switch. 

So unsure why it needs to be part of Etherchannel.

This is etherchannel config for core switch:

Group Port-channel Protocol Ports
------+-------------+-----------+-----------------------------------------------
1 Po1(SU) - Te1/1/16(P) Te2/1/16(P)   ---- for network stack.
2 Po2(SU) - Te1/1/15(P) Te2/1/15(P)    ---- for client stack
100 Po100(SU) - Te1/1/13(P) Te1/1/14(P)    for VSS
101 Po101(SU) - Te2/1/13(P) Te2/1/14(P)  for VSS

Below is from Sh Cdp n on core switch

Sw1          Ten 1/1/1         141              S I   WS-C2960- Gig 0/1

[Leo Laohoo]

So unsure why it needs to be part of Etherchannel.

Because the host MAC address is seen coming from both interfaces.  This could, potentially, mean the host may have been connected to a hub and the hub is spanning different ports/VLANs.  Track down where the host is coming from.  

[trickylalit]

Hello Leo,

I will check in few days. But there are many messages for different host like this.

We are manufacturing environment.

Some of the hosts are wireless scanner which are sitting on forklifts and move as forklifts travel between different AP's  where these AP's could be connected to Sw1 and Sw2 .

Could that be possible?

Also, does is this because of this command that these move are being logged?

mac address-table notification mac-move

Thanks,

I will be able to check again in few days when I get to office.

[Leo Laohoo]

3C:A9:F4:65:89:98

The OUI of the MAC address above is Intel.  

Find out what this machine is to determine why.  

[trickylalit]

Leo,

Thank you for suggestion. Will try in few days after the break and report .

Merry Christmas!

[trickylalit]

Leo, I found another example:

Dec 28 13:31:34 CST: %C4K_EBM-4-HOSTFLAPPING: Host A4:70:D6:B6:B3:A9 in vlan 1 i s moving from port Te1/1/1 to port Po1 Dec 28 13:31:34 CST: %C4K_EBM-4-HOSTFLAPPING: STANDBY:Host A4:70:D6:B6:B3:A9 in vlan 1 is moving from port Te1/1/1 to port Po1 I tracked this host.

This is android phone. you only connect to Wireless AP's.

So should messages like these be ignored? and result of command in config

mac address-table notification mac-move

And when I take out this from core switch where it is currently applied these messages should go away ?

Thanks

[paul driver]

Hello

from sw1 are you looping back into the vss in anyway - 

It looks like vlan 1 which is default for untagged traffic -

You have stated that switch1 has a single connection back to the vss core so then from thats witch ithere should be no other trunk or port forwarding back to the core

You mentioned Acess points -If they are connected to thats switch have you checked these-  Do you have spanning bpdu filtering enabled anywhere?

res

Paul

[trickylalit]

Hello Paul,

As of now we have flat network and yes vlan 1 which is default for untagged traffic

I don't think there is any way to loop back as there is only one link between this 2960 and core switch.

Access point are only connected to:

SW1(2960)(Will have AP's)-----Core SWITCH(4500 in VSS)----SW2(2960xStack in portchannel and will have AP's connected to it)

So When something is read off Ten 1/1/1 on core switch and later on shows up on PO1, only think I can think off is stuff connected to  AP's.

I am trying to understand how can there be loop when there is no other way to that from core to sw1. Or can there be?

And this is only happening between these two links and logging in core switch.

I saw another instance today where another cell phone mac got logged in core switch with same message.

What is the purpose for mac notifcation move command?

Is n't this behaviour reflective of the command or I am wrong.

I tried looking on the other switch and this event was not logged.

This event is only logging in core switch  which has 

mac address-table notification mac-move

applied.

Thanks