I had a event on my network core last night that has me a bit stumped.
I have two 6509 with msfc in them. There are about 25 vlans/subnets with hsrp configured for each subnet between the two msfcs in each 6509.
What I saw last night was a duplicate IP address reported by each msfc on two different vlans (1 and 15). The duplicate report was for the physical interface addresses not the hsrp virtual address. Each msfc saw it's own hsrp packet I assume.
Obviously a loop happened somewhere. What has me a bit confused is how it happened on two vlans at the same time. If a user accidentally plugged a cable in to two switch ports, I could see a loop happening but that would only be on that particular vlan. As well, if it were just some STP issue, why did it only happen on two vlans and not the others?
As a side effect (I think), I see that all of the hsrp interfaces on the standby msfc went active. I think this is a result of a cpu spike that occurred because of the loop. I can see the spike in Cricket on both routers.
I don't have any other message in the logs. No interfaces bouncing no nothing just
1. Loop on vlan1
2. Loop on vlan 15
Then all of the hsrp state change messages on the standby router as it went active and back to standby.
Whatever was causing the loop must've stopped since the whole event was over after 5 minutes and things have been normal for 14 hours now.
I've checked the uplinks and cpu stats for my edge switches to see if there are any corresponding spikes in usage there and there's nothing.
I'm at something of a loss as to what else to check to try an determine what happened.