Solved: duplicate CUT and UT endhosts entry report

steffen.plorin · ‎02-20-2008

He Experts,

I got two entrys for my LMS 2.6 server in UT on difference switches. Fact is the server is connected to Switch vre-6-neuulm-RZ11-deu Port Fa0/2 and never before on Switch dit-6-neuulm-01-ras-deu.

Is that a arp problem of this switch based on bug of IOS, we have problems with this switch arp entry, or with LMS ?

Danke Gruss Steffen

User Name

Host Name ditdenusrvipm01.eu.net.dana.com

MAC Address 00-13-21-b1-9a-f8

IP Address 10.224.44.12

Subnet 10.224.44.0

Switch dit-6-neuulm-01-ras-deu

Port Fa0/12

Port State static

VLAN inactive91

Port Speed 100M

Port Duplex full-duplex

Last Seen 2008/02/18 20:46:05

-----------------

User Name

Host Name ditdenusrvipm01.eu.net.dana.com

MAC Address 00-13-21-b1-9a-f8

IP Address 10.224.44.12

Subnet 10.224.44.0

Switch vre-6-neuulm-RZ11-deu

Port Fa0/2

Port State static

VLAN DIT1_VLAN

Port Speed 100M

Port Duplex full-duplex

Last Seen 2008/02/20 10:34:10

-----------------

dit-6-neuulm-01-ras-deu#sh mac-address-table

Dynamic Address Count: 12

Secure Address Count: 0

Static Address (User-defined) Count: 0

System Self Address Count: 50

Total MAC addresses: 62

Maximum MAC addresses: 8192

Non-static Address Table:

Destination Address Address Type VLAN Destination Port

------------------- ------------ ---- --------------------

0007.b35c.1430 Dynamic 91 FastEthernet0/4

0016.c8e5.de50 Dynamic 92 FastEthernet0/16

0030.482c.4a34 Dynamic 92 FastEthernet0/15

0030.482c.4a35 Dynamic 93 FastEthernet0/20

0050.5aeb.32fc Dynamic 92 FastEthernet0/14

0050.5aeb.34dc Dynamic 93 FastEthernet0/14

0050.5aeb.34fc Dynamic 91 FastEthernet0/5

00a0.8e35.c141 Dynamic 91 FastEthernet0/1

00a0.8e35.c14d Dynamic 92 FastEthernet0/13

00a0.8e35.c5a1 Dynamic 91 FastEthernet0/5

00a0.8e35.c5ad Dynamic 92 FastEthernet0/14

00a0.8e9e.5491 Dynamic 91 FastEthernet0/7

flash:c3500XL-c3h2s-mz-120.5.2-XU.bin

Joe Clarke · ‎02-20-2008

Not sure if those devices learn MAC addresses, but you certainly shouldn't see another duplicate appear on that port with nothing connected to it. Go ahead and delete the dup entry from UT, and it should not come back.

View solution in original post

Joe Clarke · ‎02-20-2008

Well, the code on this switch is very old, and known to be problematic. However, UT isn't typically going to make stuff up. If it said the MAC appeared on Fa0/12 on 2/18/2008, then it probably did. Something we do see from time to time is with certain network topologies, UT will report end hosts connected to uplink ports on switches. So, if this dit-6-neuulm-01-ras-deu switch's port Fa0/12 is an uplink port which is not trunking, and does not have a CDP neighbor that appears on the Campus Topology Map, then UT will not be able to tell that a MAC address which is learned on this port is not actually connected to this port.

Without seeing the full config on this switch, the show cdp neighbor output, or a debug log from when UT last found this MAC, I cannot be certain this is what you're seeing, but the symptoms fit.

steffen.plorin · ‎02-20-2008

Fa0/12 isnt a uplink port cdp is not enable on this switch I add it as seed to lms and the mac address of 10.224.44.12 was never connected on that switch.

Danke Gruss Steffen

Joe Clarke · ‎02-20-2008

But what does connect to that port? Any other switch or bridge that may have learned that MAC could cause an entry to be learned in this 3500XL. The fact that this port isn't trunking and doesn't have CDP enabled makes it a prime candidate for what you are seeing.

steffen.plorin · ‎02-20-2008

right now nothing is connected, int and protocol are down

couple days ago 3 days it was a bluecoat proxy connected but we have trouble with this box also and connected it now inside of our DMZ

Gruss Steffen

Joe Clarke · ‎02-20-2008

Not sure if those devices learn MAC addresses, but you certainly shouldn't see another duplicate appear on that port with nothing connected to it. Go ahead and delete the dup entry from UT, and it should not come back.

steffen.plorin · ‎02-20-2008

He Clarke,

I learn that the bluecoat proxys working as a bridge. Yes I will delete the wrong entry in UT and I go forward to upgrade the IOS on that switch.

Cool Danke Gruss Steffen