Mac-Flapping Bug? Switch generates logs for a MAC that doesn't exist

[Matthias.G]

There is an odd problem on the core switch right now, its a C9500-48Y4C running  IOS XE 17.09.03

Core-Switch#show logging | inc flapping
%SW_MATM-4-MACFLAP_NOTIF: Host 0026.fc2a.0000 in vlan 1259 is flapping between port Po49 and port Po51
%SW_MATM-4-MACFLAP_NOTIF: Host 0026.fc2a.0000 in vlan 1259 is flapping between port Po49 and port Po51
%SW_MATM-4-MACFLAP_NOTIF: Host 0026.fc2a.0000 in vlan 1259 is flapping between port Po49 and port Po51
(...)

This MAC is apparently flapping between 2 portchannels, however upon further research on the distribution switches behind these port-channels, no MAC like that is known. I have yet to see a bug that causes a random adress to be detected on certain ports, however I dont know what would cause this adress to not be visible in the MAC table when it is obviously connected somehow.  

Distribution-1# show mac address-table | inc 0026.fc1f.0000
Distribution-1#

Distribution-2# show mac address-table | inc 0026.fc1f.0000
Distribution-2#

[Giuseppe Larosa]

Hello @MatthewRobinson5751 ,

the document you have linked provides the following:

>> 

Change of Behaviour

Starting from 5.2(1)N1(9), 7.1(4)N1(1) for Nexus 5000 Series Switches, Cisco allocates a range of MAC addresses from 0026.0bf1.f000 to 0026.0bf2.2ffff to be used by NX-OS for Source MAC address in BPDUs sent on Virtual Port-Channel interfaces.

vPC BPDU Source MAC address = 0026.0bf1.fxxx 

where xxx is vPC port channel number.

00:26:0B Cisco Systems, Inc according to wireshark OUI search page

It is slightly different from what you have posted but the concept is correct.

But it does not apply to the MAC addresses  listed by original poster unless he masked them by zeroing the less meaningful 24 bits ( and he says he did some masking)

MAC addresses of  OP have OUI 0026.fc -> 00:26:FC AcSiP Technology Corp according to wireshark OUI search page

https://www.acsip.com.tw/index.php?action=development-detail&id=15

They are WIFI endpoints and the original poster could have had issues with roaming.

For you case the solution was to change the VPC id in one Nexus pair to avoid this MAC flapping log as seen in the rest of the network.

Hope to help

Giuseppe