Rouge mac address popping switch ports

[Russell Pearson]

Hey there,

I have port security turned on my switch stack, with a maximum of two mac addresses, one for voip phone, one for pc.

Intermittently, mac address  7e77.3777.5776 will pop the port. I can't figure out where this mac address is coming from.

Users are reporting that they didn't plug anything else into their ports. I googled that mac and nothing comes up.

Any advice on how to track this down?

Thank you.

-Russ

[lucentmoon]

That MAC isnt a registered oui according to the ieee's list.  Hard to say if its software spoofing or a physical device.  If only happening on 1 switch & no other mac addresses i'd bet its a user.  Obviously you know the port number getting shutdown/err-disabled so you should be able to lookup the mac/ip to the voip phone and contact a user right when it happens.  you could use a mac acl/filter if you're switch supports it.

[Russell Pearson]

Yes I tracked down the two users and they said they didn't plug any other devices into their data jacks.

[AP-Contracts]

Hey there,

Did you ever find out what this mac address was?

Thanks.