so that's the thing with mac move notification it can be a loop but you should see that in cpu if its spiking but it can also be legitimate users , it doesn't even have to be wireless , like a scenario if you have 5 sales guys having a meeting in building A all connected to access switch 1 there macs are recorded as coming in through that switch and up to say your core vss switches but then they get up and all move to building B and then connect to switch 2 within 5 minutes , once there macs are still in the CAM table within the 5 minutes it will register a mac move as the CAM table already sees there macs after being learned in one access switch and now a second switch , scenarios like that cause mac moves as well and the longer your CAM table is set to store them over the default the more you may se them
that's why I was saying check the macs see what they are , trace them to a user system or device see what it is then you will know more , checking for a loop is easy enough check your stp isn't constantly involved in changes it should be steady enough
The fact these are between two 10 gigs links I thought they may be the core interconnects , at some stage the mac may have been learnt through both switches but its all down to the mac and what its doing , if you have a loop your cpu will keep spiking and continue to get high and show stp as an issue in logs and in cpu along with mac move
That's why you have the ability to turn off mac move as its not always an issue and can just cause logging flooding issues depending on your design of your network
show spanning-tree detail | inc ieee|occurr|from|is exec
