Port security tripped by invalid MAC address

[jneiberger]

This is a weird one and it's happened twice in the past couple of months. We have port security active on our switches and twice we've seen it get tripped by an invalid MAC address like e8be.5bd3.5558. It's as if the machines that are connected to it temporarily switch to a different MAC address, which I've never heard of.

If I recall correctly, the first time it happened was with a printer, but I'm not 100% sure. Last night it happened again with a workstation. I did find someone else on a different forum who had experienced it but they did not know the cause.

Any ideas?

thanks,

John

[Giuseppe Larosa]

Hello John,

from previous threads

all zeros source addresses: are just started vmware instances

other sources of strange mac addresses: PCs and MACs with IPv6 stack has been by someone.

notice that usually switches complain of source mac addresses that appear to be multicast (I/G bit set to 1 on less significant digit of most significant octet)

In several of our campus networks we see warning messages every day but we haven't port security on them so they don't cause connectivity problems.

Hope to help

Giuseppe

[jneiberger]

Thanks for the ideas, but I'm just not sure what would cause a MAC address like e8be.5bd3.5558. That's a pretty strange MAC address. Until this started happening, I had never seen one that started with anything like e8be.

It doesn't appear to be happening very often. I've only seen it twice and I've only found out one instance where I know it happened to someone else. I'd sure love to get to the bottom of it, though.

[jneiberger]

I should also mention that the other person I saw with this problem (in Russia) was seeing the exact same MAC address. Very strange!