10-01-2014 06:49 AM - edited 03-07-2019 08:56 PM
Since yesterday lunchtime we've been seeing multiple MAC address flaps on our switches.
We are seeing this on all switches, but only a few MAC addresses on each switch. We route between different areas so as to keep spanning tree to a minimum. It's a star design and we use etherchannel to eliminate spanning tree and loops.
We use different switch types and different IOS levels across switches so there is really nothing in common. We have not made any changes and this has all been working for years.
Any ideas?
10-01-2014 03:14 PM
Hey,
Best way is to pick any of the MAC's and locate its original location. And then follow the other path to check for any temporary STP loops or it might be STP TCN's.
HTH.
Regards,
RS.
10-02-2014 01:14 AM
Do you have a Multicast address ? Do you have enabled proxy-arp ?
10-02-2014 01:19 AM
We use source specific multicast in each area and no proxy arp. Confirmed no loops.
10-02-2014 03:36 AM
Can you see which mac address flaps ? It is Multicast or anycast ?
10-02-2014 03:49 AM
The MAC address flaps seem to be PCs and it's not multicast traffic. Seemingly random ports. As I said the devices have been traced.
It is in every L2 vlan we use for PCs. These L2 boundaries are separated by L3 links. Almost like an infected machine in each L2 domain.
10-02-2014 06:04 AM
Think we've finally found the issue. Same as described here:
https://supportforums.cisco.com/discussion/11835361/mac-address-flapping-and-sccm-wake-proxy
Our problem coincides with a roll-out of wake on lan SCCM. Working with our desktop team to get this removed.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: