MAC address Flapping between 2 ports in switch

[W-ALI]

Hello All,

I found Fluctuating Performance just  in 1 switches (C2960) connected with PCs by F0/X ports and connected to core-Switch by up-link G0/1,

the effected PCs , just on this switches , no issue with other switches with same VLAN

as per attached print-screen there's MAC flapping between the up-link  and PC connected to port F0/1(OS windows7)

this mac related to interface VLAN created on Core-Switch

# show interfaces vlan 5
Vlan5 is up, line protocol is up
Hardware is EtherSVI, address is 001a.a2ad.9147 (bia 001a.a2ad.9147)

I think that's mean there's MAC spoofing attack .

my questions :

- does that mean there's some one use attacking tools , or maybe there's network virus ?

- does there any solution on switch to avoid that in future except the port security ?

[MHM Cisco World]

If this MAC is for VLAN then check if you assign same IP for SVI of VLAN in Access and Core.  

[W-ALI]

NO

not assign same IP

[MHM Cisco World]

if you run VM then it can happened that the broadcast is flood between the two ports of VM and hence you get this flapping message. 
check if your user is connect to Core SW also. 

[W-ALI]

No VM connected on this switch , the port F0/1 connected to PC (OS windows 7)

not all users on  VLAN 5 effected , just whom connected to this switch.

does there any virus can do that?

[MHM Cisco World · Accepted solution]

if this is SVI of VLAN is GW then you can under hack, the PC want to change the port of MAC of GW to be through it, and hence can sniff all data toward the GW. 
what you need is DAI, which block any MAC-IP from port that not match DHCP or match DAI static ACL. 

[W-ALI]

yes I agree with you , thank you very much.

[MHM Cisco World]

You are so so welcome