MAC flapping

[#1]

First post requesting help, so be gentle.

I'm getting MAC flapping errors at one of my remote sites.  I've traced the MAC using the "sh mac address-table address [mac]" command, but it keeps leading me to trunk ports going to other switches - never to an end user port.  IE:

3750->SW70->SW72->SW70->SW73->SW70->3750 or

3750->SW100->SW102->SW100->SW103->SW70->3750

All switches are 2960s except for the 3750.

How do I find and squish this issue?  I don't have any dual-homed servers on the network, but it is possible an end user is using a hub without permission.

صور معبرة | الوليد | صور حب

[devils_advocate]

Have you looked online to see what manufacturer the MAC belongs to?

It might help narrow down the search at least. 

Do you use Port Security?

BPDUGuard?

[Richard Rowe]

I did, but it belongs to some company I've never heard of.  The mac is 0050.b657.d9ce and it is to a device from Good Way Technology Co.  I presume it's probably a USB to ethernet type adapter, but that's purely a guess.

We do use BPDU guard which would shut a port if it detects a switch connected to a user port.

[devils_advocate]

Looking at their website, I would say its likely that this is a USB to Ethernet adapter. 

Is it just a single MAC flapping?

Have you looked at the ARP cache on the L3 switch/router to find out the IP address associated to this MAC (assuming it has one)?

#show ip arp 0050.b657.d9ce

[Richard Rowe]

Correct, just the one MAC flapping like crazy.  I looked on the L3 switch, but the MAC isn't in the ARP table.