cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
775
Views
5
Helpful
6
Replies

%C4K_EBM-4-HOSTFLAPPING error message

Hello Experts,

I have an issue in my network where I see almost daily the following error message in one of my CORE switches:

Mar 6 11:15:38: %C4K_EBM-4-HOSTFLAPPING: Host 00:15:00:13:C9:5F in vlan 251 is flapping between port Gi2/2 and port Gi2/1

Mar 6 11:18:10: %C4K_EBM-4-HOSTFLAPPING: Host 00:15:00:13:C9:5F in vlan 251 is flapping between port Gi2/1 and port Gi2/2

I have identified the host with the MAC address 00:15:00:13:C9:5F which seems to be a PC with a wireless connection to one of my APs:

AP_PLT_DIRPROD_01#sh dot11 associations | i 0015.0013.c95f

0015.0013.c95f 172.27.216.17 4800-radio AP_PLT_DIRPROD_ self Assoc

I have spanning-tree disabled in VLAN 251 on the AP and I don't think this issue is due to a STP loop.

Do you think this could be due to a virus on that PC? Or what do you recommend to do?

Thanks a lot!!

Juan Pablo Corrales

Network Specialist

6 Replies 6

lamav
Level 8
Level 8

What devices are connected to ports gi2/1 and 2/2?

Here is the topology:

CORE (g2/1) - L2 SW - L2 SW - AP

| |- L2 SW - L2 SW - AP

|

| (g2/2) - L2 SW - L2 SW - AP - HOST with MAC

There are Cisco switches and at the end of the chain there are APs.

The MAC address that appears in the error message is a host that is associated to an Access Point.

It looks like the wireless user is roaming and associating with different AP at different times. Hardcoding the PC to associate with the same AP always is one way to get rid of the host flapping error message.

HTH

Sundar

Sundar,

Thanks a lot for the response. That's exactly what I'm thinking is happening.

Goutam Sanyal
Level 4
Level 4

Hi Juan,

Personally don't think it could be related with virus on that PC.

This error message appears on the switch when the switch detects the specified host address as a source address on multiple ports.

Cause:-

The issue can occur due to Spanning Tree Protocol (STP) loops in the network that cause packet drops from the specific host. In addition to packet drops, STP loops lead to several other symptoms, which are listed here:

·Loss of connectivity to, from, and through affected network regions.

·High link utilization (often 100 percent).

·High switch backplane utilization (compared to the baseline utilization).

·Syslog messages that indicate packet looping in the network (for example, HSRP duplicate IP address messages).

·Syslog messages that indicate constant address relearning or MAC address flapping messages.

·An increase in the number of output drops on many interfaces.

Note:-

One or more of these symptoms independently can indicate different issues (or no issue at all). However, when you observe many of these symptoms at the same time, you must check whether a forwarding loop has developed in the network.

Source:- cisco.com

Thanks

Goutam

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco