%SW_MATM-4-MACFLAP_NOTIF: Host 6416.8db2.8742 in vlan 4 is flapping between port Gi0/46 and port Gi0/47

[mark.kimzey]

Recieving Mac flapping on the ports going to Building A and B.  Mac address is actually the address of vlan 4 gateway virtual interface at building A.  This happens for the most part everday around 1PM.  It brings down the Vlan until you reset either int g0/46 or 47 on the 2960. (activity led's on all switches blink in sync).  I have verified that there are no switching loops.  Syslog sample is below.

2013-10-31 14:53:29 local7.warning 10.1.0.20  26968: Oct 31 14:53:28: %SW_MATM-4-MACFLAP_NOTIF: Host 6416.8db2.8742 in vlan 4 is flapping between port Gi0/1 and port Gi0/47

2013-10-31 14:54:22 local7.warning 10.1.0.20  26972: Oct 31 14:54:20: %SW_MATM-4-MACFLAP_NOTIF: Host 6416.8db2.8742 in vlan 4 is flapping between port Gi0/46 and port Gi0/1

2013-10-31 14:55:07 local7.warning 10.1.0.20  26975: Oct 31 14:55:06: %SW_MATM-4-MACFLAP_NOTIF: Host 6416.8db2.8742 in vlan 4 is flapping between port Gi0/46 and port Gi0/47

when the incident happens, from the tigerswitches perspective, they see the Mac originating from g0/1 which is what I would expect.  Can anyone point me in the right direction?  I am about ready to chalk it up to tigerswitches malfunctioning, but the static timeline has me hesitant.  Let me know if you need further logs.

Thoughts:

MITM spoofing gateway mac address?

Malfunctioning Tigerswitches injecting learned mac address back into network (logs dont show any issues)

Thanks,

Mark.

[daniel.dib]

This looks very strange. You don't even have a physical loop according to your diagram. Does this always happen at the same time? Are you aware of anything that happens at that time? Some automatic system running or anything?

I would look into the Tiger switches.

Daniel Dib
CCIE #37149

[mark.kimzey]

Only physical loop is the stacked 3750 core(with stacking cables) if you can call that a loop.  Single ptp to the other switches.  I am not aware of any processes that run at the same time.  I am going to try replacing one of the SMC's and see if it alleviates the flapping from that port at least.

Thanks for your reply,

-Mark

[Rashid Thompson]

Very Starnge, indeed. Are there any wireless devices at building A, B, or C? Also what IOS version is on the 3750 stacks?