cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
6143
Views
5
Helpful
5
Replies

Strange MAC address

Mathialagan K
Level 1
Level 1

Hi All,


We are getting mac move notification for a mac address - 0000.0000.0000. Pls find below the log.


%MAC_MOVE-SP-4-NOTIF: Host 0000.0000.0000 in vlan 80 is flapping between port Gi2/11 and port Gi1/46


When i checked it, it is learning via both dynamic and static. PFB the log taken from our core switch. and suggest how to rid of this. This MAC address is showing as static in both of our core switches.


sh mac address-table address 0000.0000.0000

Legend: * - primary entry

age - seconds since last seen

n/a - not available


vlan mac address type learn age ports

------+----------------+--------+-----+----------+--------------------------

Active Supervisor:

* --- 0000.0000.0000 static No - Router

* 107 0000.0000.0000 dynamic Yes 10 Gi2/3

5 Replies 5

daniel.dib
Level 7
Level 7

What kind of device and software version is it? Are you running port-security? You shouldn't be seeing devices with that MAC. Maybe there is a device with a faulty NIC or some kind of virtual server in the network?

Have you tried following what is connected to Gi1/46?

Daniel Dib
CCIE #37149

Please rate helpful posts.

Daniel Dib
CCIE #37149
CCDE #20160011

Please rate helpful posts.

Its WS-C6509-E. One of our core switch. we have port security only in access swtiches.

s72033_rp-ADVIPSERVICESK9_WAN-M), Version 12.2(33)SXI9.


A distribution switch is connected to gi1/46

Ankur Arora
Level 1
Level 1

Do you have any wireless AP connected to any of these interfaces?

These all zero MAC addresses are typically generated by end stations such as the following:

  A traffic generator, such as Spirent SmartBits

  Certain types of servers, such as load-balancing IBM WebSphere servers

  A misconfigured router, server or end station, such as a device that transmits all-zeros broadcasts

  A faulty NIC

The workaround is to identify the end station that generates frames with an all-zero source MAC address.

The workaround that I can think of is to configure the command below and see if message disappear:

mac-address-table static 0000.0000.0000 vlan 80 drop.

Thanks

Ankur

"Please rate the post, if found useful"

Mathialagan K
Level 1
Level 1

Hi Ankur,

We have APs but not directly connected to core switch. It is connected to access switch only. Will it create any problem in wifi if we deny this mac?

Hi,

If you block this mac, i don't think there should be any prob, because this mac does not belong to any working device.

Normally this mac is sent by rogue devices or devices with faulty NICs. So blocking this mac won't create any problems.

Thanks

Ankur

"Please rate this post if found useful"

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: