Hi there,
We are experiencing some strange MACMoveNotification SNMP traps.
Jun 6 09:25:44.958 CEST: SNMP: Queuing packet to 1.1.1.1
Jun 6 09:25:44.958 CEST: SNMP: V1 Trap, ent ciscoMacNotificationMIB.2, addr 2.2.2.2, gentrap 6, spectrap 2
cmnMACMoveObjects.3.0 = 08 5D CD EC 00 00
cmnMACMoveObjects.4.0 = 517
cmnMACMoveObjects.5.0 = -127
cmnMACMoveObjects.6.0 = -127
cmnMACMoveObjects.7.0 = 1646653471
Next to the traps, I have some buffer logging about MAC flaps. But I can't match the MACs mentioned in the buffer logging to the MAC addressess found in the SNMP traps.
We are receiving 8 traps a minute, for 8 different MAC's
The strange problem is though, I can't find any of these 8 MAC's in any of the MAC tables?
I did a MAC-to-vendor lookup, and I couldn't relate any MAC to vendor.
Next, I added the trailing 00 to the front:
08 5D CD EC 00 00 ===> 00 08 5D CD EC 00
Then I actually was able to find a vendor behind it.
But my main question is, why can't I find any of these MAC addresses in the MAC/CAM table or what to do next?
thanks in advance!
