MAC address disappearing to fast from "show mac address-table interface"

[Dave Tremblay]

Hello,

I've opened a new discussion because there was a old one not solved.

PC connected to port boots, works fine.  Output from "show mac address-table interface G4/0/14" lists the MAC of the PC. After a few seconds, the "show mac ..." command produces output with no MAC address listed.  This will happen repeatedly, although sometimes the MAC once again appears. I'm constantly pinging the pc by the way.It appends in C3750 switches, C2960S switches too. My MAC address aging time it 300 sec.

What could cause this kind of behavior ? The pc does'nt move at all... Only one input packet in the switch is supposed to trigger a mac address table entry usually.

I need answers

Dave

PS: Take a look at this, I've bold the timestamp of my commands to show you what appends within 6 seconds... and I'm PINGING the PC constantly during that period

cat3750#show mac address-table int g4/0/14           -------------------- TimeStamp 0:00
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
350    0011.250d.d739    DYNAMIC     Gi4/0/14
Total Mac Addresses for this criterion: 1
cat3750#show mac address-table int g4/0/14           -------------------- TimeStamp 0:01
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
cat3750#show mac address-table int g4/0/14           -------------------- TimeStamp 0:02
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
cat3750#show mac address-table int g4/0/14           -------------------- TimeStamp 0:03

          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
cat3750#show mac address-table int g4/0/14           -------------------- TimeStamp 0:04

          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
cat3750#show mac address-table int g4/0/14           -------------------- TimeStamp 0:05

          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
350    0011.250d.d739    DYNAMIC     Gi4/0/14          -------------------- TimeStamp 0:06

Total Mac Addresses for this criterion: 1
cat3750#

cat3750#show mac address-table aging-time
Global Aging Time:  300
Vlan    Aging Time
----    ----------
cat3750#show mac address-table aging-time vlan 350
Global Aging Time:  300
Vlan    Aging Time
----    ----------
350     300

cat3750#

[andtoth · Accepted solution]

Hi,

The MAC address can disappear from the MAC address table when the switch is receiving a STP TCN (Topology Change Notification) on a non-portfast port. It will age out in 15 seconds in case of classic STP, and will be removed immediately with Rapid-STP.

When the switch receives a frame from your PC again, it will learn its MAC address based on the Source MAC in the Ethernet header.

Please check the following command to see if you see continous topology changes in vlan 350 and on which interface it's received.

show spanning-tree vlan 350 detail | in exec|changes|from

A Topology Change will occur when a port which was forwarding is going down (or to blocking state) or when a port transitions to forwarding state and the switch has a designated port.

For more information about STP TCN, please refer to the following documentations:

Understanding Spanning-Tree Protocol Topology Changes

http://www.cisco.com/en/US/tech/tk389/tk621/technologies_tech_note09186a0080094797.shtml

Understanding Rapid Spanning Tree Protocol (802.1w)

http://www.cisco.com/en/US/tech/tk389/tk621/technologies_white_paper09186a0080094cfa.shtml

Best regards,

Andras

[Dave Tremblay]

Hello Andras,

You got it right, but now, I need to find the source. I know that it's on PO5 but from which switch, it's going to another C3750 that has other switches on it too... I will investigate and keep you informed.

cat3750#show spanning-tree vlan 350 detail | in exec|changes|from
MST1 is executing the mstp compatible Spanning Tree protocol
  Number of topology changes 150437 last change occurred 00:00:25 ago
          from Port-channel8
cat3750#show spanning-tree vlan 350 detail | in exec|changes|from
MST1 is executing the mstp compatible Spanning Tree protocol
  Number of topology changes 150438 last change occurred 00:00:00
          from Port-channel5
cat3750#show spanning-tree vlan 350 detail | in exec|changes|from
MST1 is executing the mstp compatible Spanning Tree protocol
  Number of topology changes 150438 last change occurred 00:00:00
          from Port-channel5
cat3750#show spanning-tree vlan 350 detail | in exec|changes|from
MST1 is executing the mstp compatible Spanning Tree protocol
  Number of topology changes 150438 last change occurred 00:00:01 ago
          from Port-channel5

Best regards,

Dave

[andtoth]

Hi Dave,

Those topology change counters are quite high. You can use the same command I mentioned on adjacent switches to trace down the source of the TCNs.

Look for interface flapping, frequent STP port state changes by using sh span summ a few times.

Also make sure the root bridge is consistently seen across switches and it's not changing location, you can use sh span root command.

Best regards,

Andras

[Dave Tremblay]

Hello again

It's seems like I have an issue with switches connected as "switchport access", no trunk but like the following

C3750 G2/0/19 switchport mode trunk ---> C2950 G0/1  switchport mode truk ---> C2950 F0/19  switchport access---> C294 F0/24 switchport access vlan 1

MST Instance 1 is running on the C3750 with all the vlans in it but the C2900XL is STP.

If something goes up and down in the C2900XL switch, will it affect the vlan350 in MST1 or any other vlan ? Is it the native vlan on the port that could cause the issue.

See attached files for topology.

Dave

PS: Thanks again... I'm building a lab to know what's going on

[andtoth]

Hi Dave,

If an interface which does not have portfast enabled goes up or down on the 2900XL switch, it will generate/trigger a STP TCN, which will be propagated throughout the same vlan. If 2900XL would also run MST as the others, which is based on RSTP, it would only generate a TCN when interface is going up.

I would recommend you to read through the following guide to have a better understanding about the STP TCNs.

Understanding Spanning-Tree Protocol Topology Changes

http://www.cisco.com/en/US/tech/tk389/tk621/technologies_tech_note09186a0080094797.shtml

Best regards,

Andras

[Dave Tremblay]

Hello again,

Well, it's truly my switches connected as access that do cause this issue. Since it's one of the following :

MST Configuration Restrictions and Guidelines

Follow these restrictions and guidelines to avoid configuration problems:

•Do not disable spanning tree on any VLAN in any of the PVST bridges.

•Do no use PVST bridges as the root of CST.

•Do not connect switches with access links, because access links may partition a VLAN.

•Ensure that all PVST root bridges have lower (numerically higher) priority than the CST root bridge.

•Ensure that trunks carry all of the VLANs mapped to an instance or do not carry any VLANs at all for this instance.

•Complete any MST configuration that incorporates a large number of either existing or new logical VLAN ports during a maintenance window because the complete MST database gets reinitialized for any incremental change (such as adding new VLANs to instances or moving VLANs across instances).

Thanks again Andras

Dave

[andtoth]

Hi Dave,

Thanks for giving an update. I'm glad to hear that you have found the root cause of the issue on the network.

If you have any additional questions, let us know.

Best regards,

Andras