Just ran into this problem last week at a 1400 person lab training event. The client wanted wired connections as the primary due to some bad experience with hotel WiFi in the past. We had 10 people to a table, compact switch, AP for backup all connected back to 9300s and then back to our core. One of the instructors plugged in his Mac and within a few moments, port-security shut down his port. Checked the logs and saw that there were 5+ MAC addresses on the port. Swapped dongles and even changed manufacturers, and it was still a problem. Didn't have much time to troubleshoot so we just turned off port-security for that one port and let him get prepped for the training on the next day.
The next morning there were a few instructors and all of them had the issue. Disabling port-security was not an option because we could have easily flooded the CAM tables on the compact switches and had major issues. It was too late to reconfigure the entire network so that each compact switch had L3 routing to the core. We ended up configuring each port like this:
switchport port-security
switchport port-security maximum 5
switchport port-security violation protect
switchport port-security aging time 20
This allowed the device to get an IP address and then flood with bogus MAC addresses without the port shutting down or flooding the network. Once the training was underway, we started our investigation. All of these devices were corporate managed and had all been updated to Mac OS26. We grabbed some of our OS26 devices and connected to the network and did not see the same issue. We continued to monitor the devices and after a couple of hours, each machine had over 100 bogus MAC addresses! Fortunately they did not request DHCP, otherwise it would have got even messier. The only "issue" we had throughout the day was the core and distro switches complained about MAC flaps since the machines were duplicating bogus MAC addresses constantly.
I have attached some screenshots that show what we saw on the network. They were always 0030.xxxx.4000 or 0034.xxxx.4000 and would increment every 30 seconds in some cases.
