MAC Flapping with Incomplete MAC Addresses

[ThomasBarr]

Hello,

I am new to the Support Community, I joined to try and get some help resolving an ongoing issue with set of distribution level Cisco Catalyst 3850-24XS switches setup in a ring topology. 

Running rapid-pvst and I have verified that the VLANs are in a blocking state on the switch it is configured to. I am however seeing a rather strange MAC flapping event in the logs. Which shows as the following

Jan 29 03:39:41: %SW_MATM-4-MACFLAP_NOTIF: Host 004f.fc00.0000 in vlan 1 is flapping between port Te1/0/1 and port Te1/0/2
Jan 29 03:55:14: %SW_MATM-4-MACFLAP_NOTIF: Host 004f.fc00.0000 in vlan 1 is flapping between port Te1/0/1 and port Te1/0/2
Jan 29 03:58:10: %SW_MATM-4-MACFLAP_NOTIF: Host 0051.3300.0000 in vlan 1 is flapping between port Te1/0/1 and port Te1/0/2
Jan 29 04:00:44: %SW_MATM-4-MACFLAP_NOTIF: Host 0052.a900.0000 in vlan 1 is flapping between port Te1/0/1 and port Te1/0/2

I have tried following the mac-address table to identify the source but I am unable to identify the device, or configuration causing this because of the MAC address format ending in 0000.

Vlan 1 is in a administrative down state, but it seems the trunk ports between the switches were setup using native vlan 1.

Has anyone seen something like this before?

[ThomasBarr]

Bump. Any help?

[brselzer]

Hello Thomas,

If I do a vendor lookup on those macs, they don't return anything which is very strange. Have you tried to do a capture for these packets to see what they are? It seems strange that only packets with strange macs are flapping and not  "valid" traffic. It is possible the L2 headers of same packets are being corrupted or there is something on your network talking in a non-standard protocol. Either way, I would try to capture these packets to get a better understanding of what is going on. 

Hope that helps!