Mac address sent to a bad interface (another in the cache)

Cisco SOGET · ‎09-20-2018

Hi everybody

I have got a problem with a Stack of 4 WS-C3750X-24T-S IOS 15.0(2)SE9

In the cache, I see a mac address associated with a portchannel (Po7) to another switch.

eec2.019b.d16f DYNAMIC Po7

But I see in a switch connected to this stack by another portchannel (Po1) this mac address arriving as a destination : In theory it is not possible ! (It is an exemple because it's happening with other mac addresse, other switches and other portchannel).

If somebody has an idea ...

Sincerly

Laurent

ADP_89 · ‎09-20-2018

Hello Laurent,

How did you spot this? With a monitor session on the other switch?

This looks indeed strange, it could happen when the mac-address table is full because the switch will flood all the packets..

Could it be that you have the same mac address but on different vlans? Try to use the command "mac-address-table notification mac-move" so you can spot if eventually the mac is flapping around. A good look a the logs could shed some light as well.

What kind of device has a mac-address starting with "eec2"?

Cheers,

ADP

Cisco SOGET · ‎09-21-2018

Hi

I spotted this issue with a tcpdump on a server that should never see this address.

the mac-address table is not full and the mac is not flapping.

the mac address is a virtual mac address of a VM by Xen Server and in an only one vlan.

I really don't understand how it is possible !

Regards

Laurent

ADP_89 · ‎09-21-2018

Do you see this traffic constantly or do you just see a bunch of packets randomly?

Does the server who owns that IP get traffic at all?

Have you tried to clear the mac address table?

Cisco SOGET · ‎09-21-2018

no it is not permanent so it is difficlt to be sure if the paquets arrive to the right server.

I have just tried to clear the mac table and I am monitoring

Cisco SOGET · ‎09-24-2018

After the clear mac address-table I was confident about fixing the issue ... but after a few minutes the problem came back !

I will open a case to the support (maybe a bug in the IOS).

Thank you for your help.

Laurent