Re: why there are multicast entries in mac address table?. And

rawatsandeep · ‎08-17-2012

First question is why i am seeing below multicast entries in mac address table for gi1/39, gernally on all interfaces in vlan 172.

cisco4k#sh mac address-table interface gi1/39 -----> connects to a VM

Unicast Entries

vlan mac address type protocols port

-------+---------------+--------+---------------------+--------------------

172 12f3.f000.3361 dynamic ip GigabitEthernet1/39

Multicast Entries

vlan mac address type ports

-------+---------------+-------+--------------------------------------------

172 ffff.ffff.ffff system Switch,Gi1/35,Gi1/36,Gi1/37,Gi1/38,Gi1/39

Gi1/40,Gi1/41,Gi1/46,Po3,Po4

cisco4k#sh ip multicast

Multicast Routing: disabled

Multicast Multipath: disabled

Multicast Route limit: No limit

Multicast Triggered RPF check: enabled

Multicast Fallback group mode: Sparse

cisco4k#sh ip multicast interface vlan 172

Vlan172 is up, line protocol is up

Internet address is x.x.x.x/24

Multicast routing: disabled

Multicast packets in/out: 59324871/0

Multicast boundary: not set

Multicast TTL threshold: 0

Multicast Tagswitching: disabled

cisco4k#sh ip multicast interface vlan 172

Vlan172 is up, line protocol is up

Internet address is x.x.x.x/24

Multicast routing: disabled

Multicast packets in/out: 59324877/0

Multicast boundary: not set

Multicast TTL threshold: 0

Multicast Tagswitching: disabled

ddcxs01an#

--------------------------------------------

Second Q - I am seeing MAC address flaps and also CPU high on switch , could this be related to multicast entries, i belive no, what you think

cisco4k#sh ver

Cisco IOS Software, Catalyst 4000 L3 Switch Software (cat4000-I5S-M), Version 12.2(25)EWA10, RELEASE SOFTWARE (fc1)

cisco4k#sh log | in 12:F3:F0:00:33:61

Aug 17 20:33:02 starts: %C4K_EBM-4-HOSTFLAPPING: Host 12:F3:F0:00:33:61 in vlan 172 is flapping between port Gi1/38 and port Gi1/39

cisco4k#sh mac address-table interface gi1/39

Unicast Entries

vlan mac address type protocols port

-------+---------------+--------+---------------------+--------------------

172 12f3.f000.3361 dynamic ip GigabitEthernet1/39

Multicast Entries

vlan mac address type ports

-------+---------------+-------+--------------------------------------------

172 ffff.ffff.ffff system Switch,Gi1/35,Gi1/36,Gi1/37,Gi1/38,Gi1/39

Gi1/40,Gi1/41,Gi1/46,Po3,Po4

cisco4k#sh mac address-table interface gi1/38

Multicast Entries

vlan mac address type ports

-------+---------------+-------+--------------------------------------------

172 ffff.ffff.ffff system Switch,Gi1/35,Gi1/36,Gi1/37,Gi1/38,Gi1/39

Gi1/40,Gi1/41,Gi1/46,Po3,Po4

cisco4k#sh run int gi1/38

Building configuration...

Current configuration : 140 bytes

!

interface GigabitEthernet1/38

switchport access vlan 172

switchport mode access

logging event link-status

spanning-tree portfast

end

Current CPU is normal , as only one mac address is flapping ,I noticed a 99% cpu when there were multiple mac flaps for host in vlan 172, and PID 30 was using more than 80% cpu.

cisco4k#sh proc cpu sorted | ex 0.00

CPU utilization for five seconds: 24%/0%; one minute: 26%; five minutes: 27%

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

30 39654906482251773658 0 16.79% 18.86% 19.14% 0 Cat4k Mgmt LoPri

29 20350339682857418569 0 5.43% 5.57% 5.58% 0 Cat4k Mgmt HiPri

Giuseppe Larosa · ‎08-19-2012

Hello Sandeep,

the I/G bit that decides if the address is multicast or unicast is the last significant digit on the most significant byte.

In your case the most significant byte is 0x12 this means 0001001>>0<< this is still a valid unicast MAC address as the least significant digit is 0

As a result these should be unrelated to the high cpu usage you see on devices.

Use the following document to further investigate the high cpu issues

http://www.cisco.com/en/US/products/hw/switches/ps663/products_tech_note09186a00804cef15.shtml

>>This

show processes cpu

output shows that there are two processes that use the CPU—

Cat4k Mgmt HiPri

and

Cat4k Mgmt LoPri

. These two processes aggregate multiple platform-specific processes which perform the essential management functions on the Catalyst 4500. >>>These processes process control plane as well as data packets that need to be software-switched or processed.

Hope to help

Giuseppe

rawatsandeep · ‎08-19-2012

Giuseppe,

Thanks for you time and document....

I know I was not clear with describing my problem earlier in this discussion, but let me try to explain the real problem here agian.. :-)

Switch_A ---- Int Gi1/46 ==Trunk == Gi1/46 ------ Switch_B

| |

Hsrp Stby Vlan172 HSRP active Vlan 172

| |

--------------- VM/Servers on LAN ------------

Eg: Host : 12f3.f000.3361

Switch_B#

Aug 19 14:59:07 starts: %C4K_EBM-4-HOSTFLAPPING: Host 12:F3:F0:00:33:61 in vlan 172 is flapping between port Gi1/46 and port Gi1/38

Aug 19 14:59:23 starts: %C4K_EBM-4-HOSTFLAPPING: Host 12:F3:F0:00:33:61 in vlan 172 is flapping between port Gi1/38 and port Gi1/39

Switch_A#sh mac address-table vlan 172

Unicast Entries

vlan mac address type protocols port

-------+---------------+--------+---------------------+--------------------

172 0000.0c07.ac01 dynamic ip GigabitEthernet1/46

172 001d.450c.b93f dynamic ip GigabitEthernet1/46

172 001d.450c.c17f static ip,ipx,assigned,other Switch

172 12f3.f000.3361 dynamic ip GigabitEthernet1/38

172 12f3.f000.5357 dynamic ip GigabitEthernet1/46

-------------------outupt cut---------------------

I tried to shut down the interface which were flapping one by one and still obeserved below:

Switch_B#

Aug 19 15:09:57 starts: %LINK-5-CHANGED: Interface GigabitEthernet1/38, changed state to administratively down

Aug 19 15:09:58 starts: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/38, changed state to down

Aug 19 15:09:58 starts: %SYS-5-CONFIG_I: Configured from console by sdfx on vty0 (192.168.100.100)

Aug 19 15:09:59 starts: %C4K_EBM-4-HOSTFLAPPING: Host 12:F3:F0:00:33:61 in vlan 172 is flapping between port Gi1/46 and port Gi1/39

Aug 19 15:10:11 starts: %C4K_EBM-4-HOSTFLAPPING: Host 12:F3:F0:00:33:61 in vlan 172 is flapping between port Gi1/39 and port Gi1/46

Aug 19 15:10:28 starts: %C4K_EBM-4-HOSTFLAPPING: Host 12:F3:F0:00:33:61 in vlan 172 is flapping between port Gi1/46 and port Gi1/39

Aug 19 15:10:43 starts: %C4K_EBM-4-HOSTFLAPPING: Host 12:F3:F0:00:33:61 in vlan 172 is flapping between port Gi1/39 and port Gi1/46

Aug 19 15:10:44 starts: %LINK-3-UPDOWN: Interface GigabitEthernet1/38, changed state to down

Aug 19 15:10:47 starts: %LINK-3-UPDOWN: Interface GigabitEthernet1/38, changed state to up

Aug 19 15:10:48 starts: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/38, changed state to up

Aug 19 15:10:50 starts: %LINK-5-CHANGED: Interface GigabitEthernet1/39, changed state to administratively down

Aug 19 15:10:50 starts: %SYS-5-CONFIG_I: Configured from console by sdfx on vty0 (192.168.100.100)

Aug 19 15:10:51 starts: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/39, changed state to down

Aug 19 15:10:51 starts: %C4K_EBM-4-HOSTFLAPPING: Host 12:F3:F0:00:33:61 in vlan 172 is flapping between port Gi1/46 and port Gi1/38

Aug 19 15:11:06 starts: %C4K_EBM-4-HOSTFLAPPING: Host 12:F3:F0:00:33:61 in vlan 172 is flapping between port Gi1/38 and port Gi1/46

I am not sure which port the Server or VM is connected because mac flaps make me crazy and confused, may be I need to verify this with server guys, but if there is any thing you can advise here, that will be very helpful.

Thanks again..

Sandeep.

Message was edited by: Sandeep Rawat (Corrected the switch names)

tmomani · ‎08-19-2012

Hello,

MAC Movement is a common High CPU root cause for the switching platforms, in where the CPU will spend its time rewriting/updating MAC entries. This is a common issue when you have a STP instability in place. The CPU utilization will rise at any point when the problem is amplified and is spanning multiple ports. You should rather feel lucky that you have discovered the root cause to be specific with one server box rather than a complete L2 domain STP instabilities.

As of now, you should difinitly contact your server team to check for any NIC teaming (or similar config) abnormality, or any physical (interfaces, cables, adapters) problems. or maybe asking on why the VM(s) is/are changing the active port continuously? you can ask them to configur the VM to be assigned only one reserved physical interface as a proof of concept.

Cheers,

Tareq

why there are multicast entries in mac address table?. And mac flaps causing high CPU