03-10-2008 10:50 AM - edited 03-05-2019 09:39 PM
Hello Experts,
I have an issue in my network where I see almost daily the following error message in one of my CORE switches:
Mar 6 11:15:38: %C4K_EBM-4-HOSTFLAPPING: Host 00:15:00:13:C9:5F in vlan 251 is flapping between port Gi2/2 and port Gi2/1
Mar 6 11:18:10: %C4K_EBM-4-HOSTFLAPPING: Host 00:15:00:13:C9:5F in vlan 251 is flapping between port Gi2/1 and port Gi2/2
I have identified the host with the MAC address 00:15:00:13:C9:5F which seems to be a PC with a wireless connection to one of my APs:
AP_PLT_DIRPROD_01#sh dot11 associations | i 0015.0013.c95f
0015.0013.c95f 172.27.216.17 4800-radio AP_PLT_DIRPROD_ self Assoc
I have spanning-tree disabled in VLAN 251 on the AP and I don't think this issue is due to a STP loop.
Do you think this could be due to a virus on that PC? Or what do you recommend to do?
Thanks a lot!!
Juan Pablo Corrales
Network Specialist
03-10-2008 10:54 AM
What devices are connected to ports gi2/1 and 2/2?
03-10-2008 10:58 AM
Here is the topology:
CORE (g2/1) - L2 SW - L2 SW - AP
| |- L2 SW - L2 SW - AP
|
| (g2/2) - L2 SW - L2 SW - AP - HOST with MAC
03-10-2008 04:22 PM
There are Cisco switches and at the end of the chain there are APs.
The MAC address that appears in the error message is a host that is associated to an Access Point.
03-10-2008 04:30 PM
It looks like the wireless user is roaming and associating with different AP at different times. Hardcoding the PC to associate with the same AP always is one way to get rid of the host flapping error message.
HTH
Sundar
03-11-2008 06:34 AM
Sundar,
Thanks a lot for the response. That's exactly what I'm thinking is happening.
03-10-2008 11:05 PM
Hi Juan,
Personally don't think it could be related with virus on that PC.
This error message appears on the switch when the switch detects the specified host address as a source address on multiple ports.
Cause:-
The issue can occur due to Spanning Tree Protocol (STP) loops in the network that cause packet drops from the specific host. In addition to packet drops, STP loops lead to several other symptoms, which are listed here:
·Loss of connectivity to, from, and through affected network regions.
·High link utilization (often 100 percent).
·High switch backplane utilization (compared to the baseline utilization).
·Syslog messages that indicate packet looping in the network (for example, HSRP duplicate IP address messages).
·Syslog messages that indicate constant address relearning or MAC address flapping messages.
·An increase in the number of output drops on many interfaces.
Note:-
One or more of these symptoms independently can indicate different issues (or no issue at all). However, when you observe many of these symptoms at the same time, you must check whether a forwarding loop has developed in the network.
Source:- cisco.com
Thanks
Goutam
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide