MAC deteced/tracking

[Niklas.D]

Hi

So i hade a issue that i hade a loop in the network. 

This ended effecting my remote sites that OSPF got knocked out as the ISP have a loop protection and noticed that one mac was in the WAN on 2 diffrent ports. 

Well i would like not to go to my ISP to notices this configs errors. 

Is there away to track This kinda Problem.

Track and notify if a MAC appears on with a dual entery on ports? 

maybe with SNMP sending to my survaillance system? 

anyone got any good experiance with this  

[balaji.bandi]

Not sure what is the device here ? provide device and what IOS code running here ?

if this is switch you can use port-security.

[Niklas.D]

Hi BB

Thank you for the reply! 

Ofc: 

Software (cat4500e-UNIVERSALK9-M), Version 03.11.03a.E RELEASE SOFTWARE (fc1)

So i dont want to lock a MAC to a port, but i want to track it ex. 

If i see mac Address xxxx.yyyy.zzzz on te1/1 and te1/2 that would be a problem  

[balaji.bandi]

adding to another post, you would like to have active alerts you need to set up SYSLOG or SNMP trap to get information.

based on the information you can generate an email alert.

You can add Global config and port config as below :

GLOBAL

mac address-table notification change interval 10
mac address-table notification change history-size 500
mac address-table notification change
mac address-table notification threshold
mac address-table notification mac-move

snmp-server host  10.10.10.10  traps user mac-notification

INTERFACE config (which was provided already by Paul)

snmp trap mac-notification change added
snmp trap mac-notification change removed

[paul driver]

Hello

Depending on the IOS, there used to be a feature so a trap could be created as when a mac adddres of an inerface was removed or added.

int x/x
snmp trap mac-notification added
snmp trap mac-notification change removed

exit

sh mac-address table notification interface x/x