cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
483
Views
2
Helpful
5
Replies

Invalid traffic from multicast

rohitk
Level 1
Level 1

Hi!

I am getting this error on Cat 4003;

%SYS-4-P2_WARN: 1/Invalid traffic from multicast

source address 6f:f0:ac:1e:22:19 on port 2/8.

Can anyone provide me soluion.

Thanks in advance.

Regards,

5 Replies 5

sachinraja
Level 9
Level 9

Hello Rohit,

This is what I found on CCO regarding your error:

"The Invalid traffic from multicast source address syslog message is generated when the switch receives packets with a multicast MAC address as the source MAC.

Using a broadcast or multicast MAC address as the source MAC for a frame is not standards-compliant behavior. However, the switch still forwards traffic sourced from a multicast MAC address.

The syslog message indicates the multicast MAC address in the source MAC field of the frame, and the port on which the traffic was received.

The workaround is to identify the end station that is generating frames with a multicast source MAC address. Typically, such frames are transmitted from a traffic generator (for example, SmartBits) or third party devices that share a multicast MAC address, such as a load balancing firewall or server product.

Use a sniffer to identify the device generating the frames with multicast MAC addresses as source MAC addresses. This must be done at the time the messages are being logged. Start the trace at the port indicated in the error message."

Try to isolate the server/pc generating this using the sniffer.. i think this is more an informational message, and nothing much to worry . !!!

Hope this helps.. all the best.. rate replies if found uesful...

Raj

Hi!

Thank you.I'ce seen the output in error decoder.

However, I wanted some more guidelines on this.

Sniffer is helpful.

Regards,

Rohit

Hello rohit,

What exactly is connected on port 2/8 ? is it a trunk ? or is it some server ? As I told you before, this message is really not harmful, and just an alert.. Since the source address is a multicast MAC address, the return traffic will be dropped by the switch, and this is logged.. When is this happening from ? did you do any change on your network ?

The command to disable the logging of this message is

set logging level sys 3

This will work when you are telnetted to the switch. If you want to make this permanent

for every time you access the switch

set loggin level sys 3 default

Try this and let us know.. hope this helps.. all the best. rate replies if found useful..

Raj

Hi!

Thank you for reply.

My dns server is connected on that port.

We haven't made any changes.

If it not harmful then tht's fine , however I'd like to know why exactly this message comes and tracking of particular host is possible when I could see that message again.

Regards,

Yes rohit,

i really dont think this is harmful.. u can disable logging of these messages with the commands given above.. i hope this does not disrupt any of your network applications.. if you have got enough info, you can mark the case as solved, which can help others when searching.. rate replies if found useful..

Thanks mate

raj

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco