Why am I getting this in the log?

[burleyman]

This log message is on a Catalyst 4506 and the port Gi1/13 is the trunk port connecting to the core switch which is a Catalyst 6506.

and I am getting a few of them every few days or so.

Jun 27 14:04:04.846 EDT: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: Packet received with invalid source MAC address (01:80:C2:00:00:01) on port Gi1/13 in vlan 117

Now I know the MAC-Address is for the CPU (correct me if I am wrong).

What I don't know is why these are happening and what would cause this? And how can I fix it?

Thanks for your help.

Mike

[Peter Paluch]

Hi Mike,

Interesting. The MAC address under question is used for MAC Pause frames, but only as a destination MAC. Understandably, a multicast MAC address may never be used as a source address. See:

http://standards.ieee.org/develop/regauth/grpmac/public.html

To my best knowledge, Cisco Catalysts have no or only limited support for MAC Pause frames. Is it possible that these frames are injected into your network by a non-Cisco device? Is this the only switch logging this error?

Best regards,

Peter

[Leo Laohoo]

Freak me!  Please don't tell me Peter that you've memorized the MAC address.

[Peter Paluch]

Hello Leo,

No, certainly not. I've just done my Google job. But the address was somehow familiar to me because it strongly resembled the MAC address used in STP.

Best regards,

Peter

[Chaitra Shree]

Hi Mike,

The error message is generally seen when 4500 is connected to a device with faulty NICs,drivers, cards or application. A packet with a dummy multicast source address(STP in this case) is received and is treated as invalid. Please check if the card on the 6500 connecting the 4500 is not faulty.

Since it is a trunk port, another possibility could be VLAN leakage.VLAN 117 may be handling mac-address of any other vlan as well. Do you see CPU spiking up on 4500 ?

Regards,

Chaitra

[Peter Paluch]

Chaitra,

Please correct me if I am wrong here but Cisco Catalysts generally use the MAC address 01:80:C2:00:00:00 for STP BPDUs while the address under question is 01:80:C2:00:00:01 - so presumably not STP.

Best regards,

Peter

[burleyman]

Thanks for you help on this. No this is not the only switch getting these, I am getting them on all the switches at this site except the core which has VLAN 117. I have attached a topology diagram. I googled the MAC address and it said something about the CPU which is why I thought that.

I have also opened a TAC case and am waiting to see what they say.

As for STP, while it is running we do not have redundant links. I know, I know...but not my setup and I am working on Ether-channeling the switches together...but that is another day.

the CPU is not spiking on any of the switches and I am not really getting any major complaints but there are from time to time some intermittent issues. Plus I don't want something bad to happen if I can prevent it.

Mike

[burleyman]

Forgot diagram...

[Chaitra Shree]

Hi Peter,

Yes, you are right. I over-looked the mac-address as it resembles the one used for STP BPDUs, my bad

Regards,

Chaitra