Mac address issue

[neonetad]

Hello.
I recently saw this error :

"25352: SW-4500: 025337: (Suppressed 2985 times)Packet received with invalid source MAC address (0181:48:00:00:00) on port Te1/7 in vlan 1".

I looked at the this error during last month saw it again with different mac address.
The problem is those various mac addresses are not related to any vendor at all.
... on this port there is not mac address filtering such as port security or etc. This error came often with different mac addresses every time.

Any ideas?
Best Regards.

[Kasun Bandara]

@neonetad hi, error is explaining the issue. You can try to have a MAC trace to identify the packet originator. check if there is any unauthorized devices connected to network or if any traffic generators.

[neonetad]

I already check the arp and mac address table. didn't find any of this mac addresses. It's like they appear with error and then disappearing?
what else should I try?

[MHM Cisco World]

you can use port-security
then add this mac to any non used port 
here is the port-security see this mac then it will not allow to send traffic through port. 
it can one of l2 hacking or it can vm send this bad mac. 

Thanks A Lot
MHM

[neonetad]

Well, since there are various mac address, and plus I'm not sure if these are all mac addresses.
So thinking using port security, and add trusted mac address to it. but I don't know how much mac address I can add.
overall if it work it would be the best.

But if didn't work, how to demonstrate where they come from?
It may be part of services on the network, or not!
a part from, port security, how to find this mac addresses?

[MHM Cisco World]

https://learningnetwork.cisco.com/s/question/0D53i00000KswcrCAB/packet-received-with-invalid-source-mac-address

This good article about this issue 

Three reason 

1- faulty nic 

2- ipv6 is enable in nic when sleep it use ipv6 mac

3- 4500 bug 

Check which one is your case.