mac flapping notification issue

[anoop verma]

Dear All,

All of a sudden my switch (cisco3850) start throwing below message:-

Log Buffer (16384 bytes):

%SW_MATM-4-MACFLAP_NOTIF: Host 3440.b5c4.c50a in vlan 3221 is flapping between port Gi1/0/22 and port Po1

below is the device details:-

Version 03.06.00E RELEASE SOFTWARE (fc3).

Please suggest how i can troubleshoot this problem.

[fuzzytoozy]

You can use access-list to filter that MAC. First of all you should verify what device has this mac address and what port Gi 1/0/22 or Po1 it shoud reside on. After you figure out that you can find from which equipment this MAC should not be originated. Check equipment that sends incorrect source mac address. clear CAM table / add-delete vlan / reload device / add filter to deny inbound frames with source mac 3440.b5c4.c50a on port where this mac address should never be source. 

This issue can also reveal itself in specific VPLS VLAN based configurations. 

I recommend switch from VLAN based xconnects to service instance based in that case. 

[anoop verma]

Hello fuzzytoozy,

I want to know how switch is learning one mac on two different interface, if STP is working fine.

[Mark Malone]

Are you using wireless at all , if you are and the user moves around , mac will be already learnt through one port , when he moves and reconnects somewhere switch can learn it again through another uplink causing this alert as it already sees it in the cam table , Ive seen it a few times at access level with wireless devices laptops phones etc when users move about , find our what that mac is belongs to

[pwwiddicombe]

Are you seeing these occasionally, or filling the logs?

One or two entries occasionally from PC's moving is normal.

Flooding means you have some type of loop happening - either mixing spanning tree types, or minihubs cross connected so spanning tree detection not working.  Having spanning-tree bpduguard on end user ports works wonders to reduce the occurrence of "creative user connections".