Logs %C4K_EBM-4-HOSTFLAPPING: STANDBY:Host 0C:07:AC:00:00:1B

[jong_r0602]

Hi Guys,

     Good Day! Im receving this type of log on my 4507 switch. Appreciate if someone could give us an explanation on this and how to resolve this item. I cant find also the MAC address owner in ieee either

Jun 16 09:59:56 EDT: %C4K_EBM-4-HOSTFLAPPING: Host 0C:07:AC:00:00:1B in vlan 29 is moving from port Gi5/13 to port Gi5/20

.Jun 16 10:00:03 EDT: %C4K_EBM-4-HOSTFLAPPING: STANDBY:Host 0C:07:AC:00:00:1B in vlan 29 is moving from port Gi5/2 to port Gi5/20

[cadet alain]

Hi,

You won't find this address in IEEE as it is a multicast address for Cisco HSRP. Your standby virtual MAC address for group 27(0x1B) is flapping.

Here is a doc explaining the problem:http://www.cisco.com/en/US/products/hw/switches/ps4324/products_tech_note09186a008063c36f.shtml

Regards.

Alain.

[jong_r0602]

Hi Alain,

           Thank you for your response but i've already read this document too before. It looks like HSRP but the Cisco TAC said it is not an HSRP MAC. HSRP MAC is 0000.0c07.acxx where XX is the group number. Besides, i have only 1 group which is group "0". This is the Virtual IP of my VLAN 29. The TAC also said that it could be a virus infection in one of our hosts in network. Is there any reason why this is happening? Thank you

Vlan29 - Group 0

  State is Active

    5 state changes, last state change 39w1d

  Virtual IP address is 192.168.29.1

  Active virtual MAC address is 0000.0c07.ac00

    Local virtual MAC address is 0000.0c07.ac00 (v1 default)

  Hello time 3 sec, hold time 10 sec

    Next hello sent in 0.400 secs

  Preemption enabled

  Active router is local

  Standby router is 192.168.29.3, priority 90 (expires in 9.888 sec)

  Priority 100 (default 100)

  Group name is "hsrp-Vl29-0" (default)

[cadet alain]

Hi,

Yep you're right I spoke( wrote) too fast.

Unfortunately I can't help you much then.

Regards.

Alain.

[jong_r0602]

Hi Alain, i really appreciated your response bro. Still hoping that someone could help me to sort out this issue in my network.

Regards,

Jong 

[johnlloyd_13]

Hi Jong,

It would be wise if you would push Cisco TAC to investigate further on your issue since you've initially opened a case with them.

Sent from Cisco Technical Support iPhone App

[casanavep]

Years have gone by, so sure you have figured this out. But since I stumbled on it, I figure someone who needs help may too.  This is typically caused by a LAN loop.

- If those are both ports go to 'user' devices: there may be a misconnection such as PC port and switch port of a VoIP phone connected to the wall plate, thus bridging (LAN looping).  It could also be a dual uplinked hub or 'dumb' switch not running STP.  I would make sure that any Cisco switch userports that have 'spanning-tree portfast' enabled are also running 'spanning-tree bpduguard enable' to ensure that frames only expected from switches (BPDUs) can trigger a port shut if seen. If you cannot run bpduguard, you should not run portfast!  Small unmanaged switches often do not run STP, do be careful that they do not become dual uplinked.

- Wireless Roaming (ports go to APs or switches feeding APs): When layer two wireless bridges connected users directly to the LAN (not CAPWAP tunneled to a controller) either because they are autonomous more or 'FlexConnect' is enabled (users for select WLANs/SSIDs locally bridged), MACs may 'flap' if rapidly hopping beween two APs.

- Trunking Misconfguration:  Verify "ALL" trunking in your network does NOT have PortFast enabled.  Flaps on one switch may not indicate it is the miconfgured switch, only that it is seeing flappping.  The entire LAN most be looked at.   Portfast disables loop avoidance, STP.

[nap.deguzman]

Hi

I also have this problem, did you find the solution to this issue? I would appreciate if you can share...Thanks!

[casanavep]

did you verify that none of the following exist:

- If those are both ports go to 'user' devices: there may be a misconnection such as PC port and switch port of a VoIP phone connected to the wall plate, thus bridging (LAN looping).  It could also be a dual uplinked hub or 'dumb' switch not running STP.  I would make sure that any Cisco switch userports that have 'spanning-tree portfast' enabled are also running 'spanning-tree bpduguard enable' to ensure that frames only expected from switches (BPDUs) can trigger a port shut if seen. If you cannot run bpduguard, you should not run portfast!  Small unmanaged switches often do not run STP, do be careful that they do not become dual uplinked.

- Wireless Roaming (ports go to APs or switches feeding APs): When layer two wireless bridges connected users directly to the LAN (not CAPWAP tunneled to a controller) either because they are autonomous or 'FlexConnect' is enabled (users for select WLANs/SSIDs locally bridged), MACs may 'flap' if rapidly hopping beween two APs.

- Trunking Misconfguration:  Verify "ALL" trunking in your network does NOT have PortFast enabled.  Flaps on one switch may not indicate it is the miconfgured switch, only that it is seeing flappping.  The entire LAN most be looked at.   Portfast disables loop avoidance, STP.

[nap.deguzman]

Thanks Casanavep! Appreciate the help...I will really have to look thoroughly in the configuration.