MAC Address flapping on Host ports?

[ahmad82pkn]

Hi, today we faced MAC Address flapping on our network that caused some down time.on investigation and narrowing down the issue, final tail switch is showing flapping among Trunk port and Host ports.

my Question is that, if Flapping happening between Trunk ports or Hub ports that is understandable, but WHY Flapping happens on host ports?

for example below is log, where Gi1/0/51 is trunk, but all other ports have end PC connected to it.

so in what situation cisco switch saying that end host is causing mac flapping? doesnt make any sense to me :s

Nov 28 04:54:57.115: %SW_MATM-4-MACFLAP_NOTIF: Host c81f.664b.963a in vlan 712 is flapping between port Gi1/0/51 and port Gi1/0/42
Nov 28 04:55:04.452: %SW_MATM-4-MACFLAP_NOTIF: Host c81f.664b.476e in vlan 712 is flapping between port Gi1/0/40 and port Gi1/0/51
Nov 28 04:55:07.933: %SW_MATM-4-MACFLAP_NOTIF: Host c81f.664b.4825 in vlan 712 is flapping between port Gi1/0/15 and port Gi1/0/51
Nov 28 04:55:08.856: %SW_MATM-4-MACFLAP_NOTIF: Host c81f.664b.9736 in vlan 712 is flapping between port Gi1/0/51 and port Gi1/0/46
Nov 28 04:55:09.695: %SW_MATM-4-MACFLAP_NOTIF: Host c81f.664b.4825 in vlan 712 is flapping between port Gi1/0/15 and port Gi1/0/51
Nov 28 04:55:09.814: %SW_MATM-4-MACFLAP_NOTIF: Host c81f.664b.476e in vlan 712 is flapping between port Gi1/0/40 and port Gi1/0/51
Nov 28 04:55:10.698: %SW_MATM-4-MACFLAP_NOTIF: Host c81f.664b.96b9 in vlan 712 is flapping between port Gi1/0/24 and port Gi1/0/51
Nov 28 04:55:13.215: %SW_MATM-4-MACFLAP_NOTIF: Host c81f.664b.963a in vlan 712 is flapping between port Gi1/0/42 and port Gi1/0/51
Nov 28 04:55:15.455: %SW_MATM-4-MACFLAP_NOTIF: Host c81f.664b.967c in vlan 712 is flapping between port Gi1/0/51 and port Gi1/0/8
Nov 28 04:55:19.335: %SW_MATM-4-MACFLAP_NOTIF: Host c81f.664b.9736 in vlan 712 is flapping between port Gi1/0/51 and port Gi1/0/46
Nov 28 04:55:20.377: %SW_MATM-4-MACFLAP_NOTIF: Host c81f.664b.94c2 in vlan 713 is flapping between port Gi1/0/51 and port Gi1/0/1
Nov 28 04:55:24.456: %SW_MATM-4-MACFLAP_NOTIF: Host c81f.664b.476e in vlan 712 is flapping between port Gi1/0/40 and port Gi1/0/51
Nov 28 04:55:24.697: %SW_MATM-4-MACFLAP_NOTIF: Host c81f.664b.967c in vlan 712 is flapping between port Gi1/0/8 and port Gi1/0/51
Nov 28 04:55:25.176: %SW_MATM-4-MACFLAP_NOTIF: Host c81f.664b.94c2 in vlan 713 is flapping between port Gi1/0/1 and port Gi1/0/51
Nov 28 04:55:25.176: %SW_MATM-4-MACFLAP_NOTIF: Host c81f.664b.9736 in vlan 712 is flapping between port Gi1/0/46 and port Gi1/0/51
Nov 28 04:55:25.697: %SW_MATM-4-MACFLAP_NOTIF: Host c81f.664b.96b9 in vlan 712 is flapping between port Gi1/0/24 and port Gi1/0/51
Nov 28 04:55:27.252: %SW_MATM-4-MACFLAP_NOTIF: Host c81f.664b.481c in vlan 710 is flapping between port Gi1/0/51 and port Gi1/0/5

[Rajeev Sharma]

Hey,

As per the syslog mac-address c81f.664b.481c is flapping on those two ports so it looks like you had observed a loop in the network where the blocking/alternate link on this switch went in to forwarding and it started learning the mac-address from uplink port as well, hence mac-flap.

HTH.

Regards,

RS.

[paul driver]

Hello

If you know your network and how it interconnets i would suggest the following each interconnecting switch

sh int trunk
sh spanning-tree vlan 712 ( i have just chossen that vlan from you syslog posting)

You should be able to indentify what trunks port or ports should be in a forwarding state and what should not be.

Also if you have spanning-tree bpdu-filter or portfast feature enabled on any ports you are aware of that are connecting to switching/hub devices other than end users pc/servers/printers etc... then disable it.

Lastly I would suggest to apply spanning-tree bpdu-guard at the interface level on all edge ports also.

res

Paul