Switches getting 2 MACs on 1 Port causing problems

[WicklundC]

We have 2950 2960S and 2960X switches out at our locations(650 locations). Each port on these have Port Security turned on, limited to 1 mac address and stickied. We have mini PC's from a Vendor Radiant Systems which we think keeps broadcasting 2 mac addresses, randomly tripping our port security. We've been having issues with this particular device, across multiple locations.We've contacted Radiant, and have been told no other customers have this issue and they beleive it is something with our network.

Mac address of a PC 00e0.0db6.2181 - showing in mac table, printed on end device, showing in ipconfig, relates to Radiant Systems.

Mac address tripping port security 7261.6e73.6163 - showing on log tripping port security.

One thing different about these PCs, there is 1 controller and 3 other devices which get DHCP off the controller.

The controller and other devices are all having the same issue, it is very random and sparatic.

I have not yet opened a TAC case, as I beleive this is an end device problem.

We must have port security on our ports per PCI requirements.

Thought I'd open up the question here and see if anyone has any input.

[devils_advocate]

If you up the limit to 2 on one of the ports, does it stop error-disabling?

From what you have said, it does sound like the device has a second MAC address somewhere on it. What OS is the Mini computers running? Have you checked the Network adapters within the OS on the machines?

[WicklundC]

It does stop error disabling if we were to do that, but we are trying to avoid allowing 2 mac addresses for security reasons. We process more credit card transactions than you could imagine. The second mac address isnt always there, it appears randomly.

These are small form factor PCs, the controller has 2 NICs on it, but the mac address of them do not reflect the one tripping port security. The other clients of that controller, each have 1 NIC and 1 Mac, and also having the same issue. They are running Windows 7. We've tried mutliple drivers apparently. That mac address is an unknown mac address when looked up online. We were thinking if there is a possiblity the IOS is throwing some random mac out, so I decided to just ask, see if anyone has ever seen this before.

[Rolf Fischer]

Mac address tripping port security 7261.6e73.6163 - showing on log tripping port security.

The remarkable thing with this MAC address is that it is a locally administered address, not a burned-in address.

It seems unlikely that someone changes a edgedevice's MAC-address  temporarily from the BIA to a LAA, so maybe this is done by software. I'm afraid that's not a great help...

[devils_advocate]

If you have verfied the physical MAC addresses on the connected host then as Fischer says, it could be something software related.