Re: multiple mac addresses found in one interface

wuh · ‎09-20-2013

hi, there,

we have many interfaces on our access layer switches, each of them are connected with two devices, a phone and a computer, how ever, we found each of the interfaces with many mac addresses, some of them even with hundreds. The devices are not servers, only workstations.

these mac addresses are gone when we bounce the ports but eventually come back. and they dont have any entris in the ARP table.

any one expereinced this kind of issue?

Besides we have cisco NAC configured but are not forced. dont know whether this can cause the problem or not

thanks,

amabdelh · ‎09-20-2013

Can you provide the output of shoe mac address for any of these ports?

Sent from Cisco Technical Support iPhone App

Arunagiri Nallusamy · ‎09-20-2013

There are many ressons this issue could occur. One of the mpst common reason is a L2 loop. Also at times if there is a patch panel in between the switch and the end devices, there is a possibility that the MAC addresses could get bridged.

1. Could you enable mac move notifications in your switch? You could enable the same by issuing the command "mac-address-table notification mac-move" or "mac address-table notification mac-move" in the global configuration mode. Either of the commands will be supported as per the switch platform.

2. On enabling the mac-move notification, check your "show log" output to check if there are any MAC address flap logs.

3. Also, could you post the output of "show mac address-table interface x" or "show mac-address-table interface x". X is the interfsce number. Collect the output of two or three such interfaces?

4. Is this issue observed for only one VLAN or multiple VLAN's? In other words, are all the affected interfaces belong to a single voice and data VLAN or are they spread over multiple VLAN's?

Please keep us posted.

Sent from Cisco Technical Support Android App

wuh · ‎09-23-2013

Here is a example of the show mac- results. on port g6/32, there are 4 mac addresses, all of them are actually phantom macs. they dont have any entry in the arp table. the mac addresses are from Cray Communications and i suppect it has somethinng to do with the old IP phone.

switch #sh mac-address-table | i 0000.8

* 212 0000.8011.0323 dynamic Yes 295 Gi6/32

* 211 0000.8011.0ed4 dynamic Yes 235 Gi2/10

* 212 0000.8011.01 8e dynamic Yes 285 Gi6/32

* 212 0000.8011.f971 dynamic Yes 220 Gi6/32

* 212 0000.8011.01ef dynamic Yes 285 Gi6/32

after a couple of minutes later, when i do it again, only two of them come up and they are real.

switch#sh mac- int gi6/32

Active Supervisor:
* 212 88ae.1db1.d771 dynamic Yes 0 Gi6/32
* 218 000a.e402.5eb9 dynamic Yes 35 Gi6/32

because this happens in many of the ports and switches with a very large mac table, it's caused the switches down for many times.

also, i think it might not be related to moving mac addresses around, because of the numbers of the mac and the timeit lasts.

thanks, Han

amabdelh · ‎09-23-2013

are these ports access ports or trunk?

wuh · ‎09-23-2013

See the port confi, thanks,

#sh run int gi6/32
Building configuration...

Current configuration : 650 bytes
!
interface GigabitEthernet6/32
description User_Port
switchport
switchport access vlan 212
switchport mode access
switchport voice vlan 218
speed auto 10 100
authentication event fail action next-method
authentication host-mode multi-auth
authentication order dot1x mab
authentication priority dot1x mab
authentication periodic
authentication timer reauthenticate server
authentication violation replace
snmp trap mac-notification change added
no snmp trap link-status
dot1x pae authenticator
dot1x timeout tx-period 10
spanning-tree portfast edge
spanning-tree bpduguard enable
service-policy input QOS-ACL-CLASSIFY-policy
end

amabdelh · ‎09-23-2013

This is really weird, same host is sending differemtn mac address belong to different vendors!!

000080

Cray Communications A/S (was: Dowty Network Services

88AE1D

COMPAL INFORMATION(KUNSHAN)CO.,LTD

000AE4

Wistron Corporation

If only the PC or the IP phone is connected, do you see the same behavior? one of these devices is flooding all these mac addresses, and this is not expected

wuh · ‎09-23-2013

Amjad,

The only happened with specific type of phone connected, as far as i know. and from our ISE, I see a lot of Unknown mac-address, starting with Cray communicatins.

Besides the TCam is running out of Mask part sometimes, i suspect, it is a results of these phantom macs.

thanks,

Han

amabdelh · ‎09-23-2013

I never seen this with IP Phones, but I would recommend to check the phones and the PC, make sure the PC is not doing any mac spoofing.

Regards

Peter Koltl · ‎09-24-2013

I have seen faulty phones looping back all frames and causing huge flooding.

danishahammed015 · ‎05-11-2014

Hi

Did you manage to find the solution for your Issue ?

I am having the same issue with one of my customer.

Fvicente · ‎09-06-2017

Hi,

sorry to move up this post. We got the same issue(maybe worst) , we see multiple mac address on all interface where an IP phone is connected (SW-> IP phone-> PC)

this probleme appear not only in one switch but on lot of them , on different VLAN and on multiple distant site.

We got security violation because we only allow 3 mac adress, here an example of interfaces(the mac address change on the data vlan) :

HODSWI054#              sh mac address-table | in 0/14
100    0023.249b.c4f8    STATIC      Fa0/14
100    c89c.dc70.1e4c    STATIC      Fa0/14
200    e05f.b979.4672    STATIC      Fa0/14
HODSWI054#              sh mac address-table | in 0/8
100    0023.246d.3868    STATIC      Fa0/8
100    0023.248d.f214    STATIC      Fa0/8
200    e05f.b979.76d1    STATIC      Fa0/8
HODSWI054#              sh mac address-table | in 0/43
100    0023.24ab.f644    STATIC      Fa0/43
100    c89c.dc70.1d8f    STATIC      Fa0/43
200    e05f.b979.786d    STATIC      Fa0/43
HODSWI054#

on our Core switch we got vlan flapping too :

000266: Sep 7 08:26:25.445 MET: %C4K_EBM-4-HOSTFLAPPING: Host C8:9C:DC:70:1E:5B in vlan 108 is flapping between port Gi7/4 and port Po1
000267: Sep 7 08:29:53.783 MET: %C4K_EBM-4-HOSTFLAPPING: Host 00:23:24:6D:38:64 in vlan 96 is flapping between port Gi6/3 and port Po1
000268: Sep 7 08:33:03.530 MET: %C4K_EBM-4-HOSTFLAPPING: Host C8:9C:DC:70:1D:8F in vlan 100 is flapping between port Po1 and port Gi8/3

seems we see on interfaces the mac address of the PC connected to other IP phones

we put on the global configuration the command "mac address-table notification mac-move" but nothing on the "show logg"

please help us

regards,

fabrice

Jean Matthew · ‎09-28-2017

Hi wuh,

have you found where was the issue?

Thanks

Anouar_network · ‎07-06-2018

Hello wuh,
did you find the solution? I'm facing the same issue.
thank you

ubuemebrit@gmail.com · ‎01-09-2019

Hello Guys,

It seems there has not been any solution regards the below issue.. i recently started experiencing the same issue and would like your input.

i have a single interface been violated by numerous MAC addresses... these interface has a single camera connected to it.

please see attached error logs for this issue