MAC addresses constantly Deleted and Added

[sebastian.lemke]

Hi,

I am experiencing a strange behaviour on a WS-C2960X-24TS-L running c2960x-universalk9-mz.150-2a.EX5.bin.

MAC addresses are constantly deleted and Added on one port. I configured the following:

mac address-table notification change interval 10
mac address-table notification change history-size 200
mac address-table notification change

interface GigabitEthernet1/0/24

 snmp trap mac-notification change added
 snmp trap mac-notification change removed

The MAC address aging time is set to 300 s. When issuing a "show mac address-table notification change" I can see a number of MAC addresses being deleted and added every few seconds on the interface Gi1/0/24. The MAC addresses are not learned on any other port. Most of the time they don't appear in the output of a "show mac address-table". Only when constantly issuing this command i sometimes hit a moment where the MAC address is allocated to the interface Gi1/0/24.

Anybody a hint why this is happening?

[Zach S]

Sebastian,

What is port Gi1/0/24 connected to, a wireless AP, a switch, a PC, etc...

[nicos AG]

It is connected to another switch of the same type running the same IOS version.

The port is configured as static dot1q trunk allowing all VLANs.

**edit: sorry, accidently logged in with different account**

[Zach S]

Follow questions, are there any other trunks or connections hanging off of that switch and what type of STP are you running?

[sebastian.lemke]

Yes, there are four dot1q trunk ports, the mentioned interface Gi1/0/24 being one of them.

The switches are running rapid-pvst.
 

[Zach S]

Sebastian,

If you run "show spanning-tree" multiple times when the MAC addresses pop in and out, do you notice any changes in the output?

[sebastian.lemke]

IOS Upgrade to c2960x-universalk9-mz.152-2.E3 fixed the problem.

[dbergman13]

We are experiencing the same issue with the C2960S. Can you confirm that you are no longer having this issue?

[sebastian.lemke]

Yes, confirmed.

IOS Upgrade to c2960x-universalk9-mz.152-2.E3 fixed the problem.

[dbergman13]

Thank you!

[dbergman13]

Upgraded one of our C2960-S switches to version 152-2.E4 and we still have the issue. This particular issue is on an access port connected to a Canon Printer and the mac address gets added/deleted every 4-5 mins. Happening on several of our C2960-S Models.

[sebastian.lemke]

This does not look like the same problem I had ("a number of MAC addresses being deleted and added every few seconds").

Maybe in your case the problem is rather related to the printer than to the switches.

[pwwiddicombe]

I'm not sure what the mac address default aging time is, but you have to remember how it works...  If nothing is seen from the device in that period, it will age out.  Next packet from the device will create a new one.

If your aging time is shorter than the interval that an "idle" printer or device happens to reply to a request or make a request, then the address will be deleted, then automatically be recreated when seen again.  So if an idle printer is polled every 6 minutes and your aging time is 5 minutes, you will see recreation of mac addresses. 

Remember, this isn't an ERROR, it's the way to keep tables clean, and part of normal operation.

[dbergman13]

The problem is that non-windows devices are having this issue, even linux boxes in our virtual environment. I already tried changing the aging time to 3600 (60mins) and it was still deleting and adding the mac addresses. Here is the mac address table notification change log, which shows that the device is being added and deleted about every 2-5 mins based on the timestamp/uptime:

History Index 1, Entry Timestamp 32679349, Despatch Timestamp 32679349
MAC Changed Message :
Operation: Added Vlan: 90 MAC Addr: 001e.8fd7.8bc6 Dot1dBasePort: 27

History Index 2, Entry Timestamp 32713476, Despatch Timestamp 32713476
MAC Changed Message :
Operation: Deleted Vlan: 90 MAC Addr: 001e.8fd7.8bc6 Dot1dBasePort: 27

History Index 3, Entry Timestamp 32751435, Despatch Timestamp 32751435
MAC Changed Message :
Operation: Added Vlan: 90 MAC Addr: 001e.8fd7.8bc6 Dot1dBasePort: 27

History Index 4, Entry Timestamp 32785993, Despatch Timestamp 32785993
MAC Changed Message :
Operation: Deleted Vlan: 90 MAC Addr: 001e.8fd7.8bc6 Dot1dBasePort: 27

History Index 5, Entry Timestamp 32801756, Despatch Timestamp 32801756
MAC Changed Message :
Operation: Added Vlan: 90 MAC Addr: 001e.8fd7.8bc6 Dot1dBasePort: 27

History Index 6, Entry Timestamp 32853690, Despatch Timestamp 32853690
MAC Changed Message :
Operation: Deleted Vlan: 90 MAC Addr: 001e.8fd7.8bc6 Dot1dBasePort: 27

History Index 7, Entry Timestamp 32895489, Despatch Timestamp 32895489
MAC Changed Message :
Operation: Added Vlan: 90 MAC Addr: 001e.8fd7.8bc6 Dot1dBasePort: 27

History Index 8, Entry Timestamp 32952925, Despatch Timestamp 32952925
MAC Changed Message :
Operation: Deleted Vlan: 90 MAC Addr: 001e.8fd7.8bc6 Dot1dBasePort: 27

History Index 9, Entry Timestamp 32967459, Despatch Timestamp 32967459
MAC Changed Message :
Operation: Added Vlan: 90 MAC Addr: 001e.8fd7.8bc6 Dot1dBasePort: 27

History Index 10, Entry Timestamp 33002013, Despatch Timestamp 33002013
MAC Changed Message :
Operation: Deleted Vlan: 90 MAC Addr: 001e.8fd7.8bc6 Dot1dBasePort: 27

[Masoud Pourshabanian]

Is it a stable port? Have you tried to change its Ethernet cable? Any redundant path exist to your other switch?