Wierd MAC Flapping Errors

Unanswered Question
Mar 9th, 2009
User Badges:

We had an issue with a MAC flapping in our network today. We've dealt with this before and for the most part have eliminated it with BPDU guard.


Today's MAC flapping seemed different since instead of a bunch of different MACs flapping between their port and the port towards the loop. Something like below with Gi1/32 being the port towards the loop:


%C4K_EBM-4-HOSTFLAPPING: Host AAA in vlan 100 is flapping between port Gi1/1 and port Gi1/32

%C4K_EBM-4-HOSTFLAPPING: Host BBB in vlan 100 is flapping between port Gi1/2 and port Gi1/32

%C4K_EBM-4-HOSTFLAPPING: Host CCC in vlan 100 is flapping between port Gi1/3 and port Gi1/32


We saw the same MAC flapping between many “Access Ports” and the port towards the loop. Something like this:


%C4K_EBM-4-HOSTFLAPPING: Host XXX in vlan 100 is flapping between port Gi1/1 and port Gi1/32

%C4K_EBM-4-HOSTFLAPPING: Host XXX in vlan 100 is flapping between port Gi1/2 and port Gi1/32

%C4K_EBM-4-HOSTFLAPPING: Host XXX in vlan 100 is flapping between port Gi1/3 and port Gi1/32


The former case make sense to me since frames with the MAC addresses of the hosts on ports Gi1/1-3 get forwarded down Gi1/32 got looped and come back to the switch. But the case we saw today make no sense to me since ports Gi1/1-3 are not loops and do not have hosts with MAC address XXX on them.


It's still not clear how this loop happened, but it looks like something to do with a host with two NICs with unknown OS or config.


Can anyone shed any light on how we could have seen the behavior we saw today?


Thanks,

Joe


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Sebastian Helmer Mon, 03/09/2009 - 23:00
User Badges:
  • Silver, 250 points or more

Hello,

is this maybe a problem in a link aggregation configuration?

Or, we had this problem on Ports where a Access Point was connected to..


best regards, Sebastian

c2jkeegan Tue, 03/10/2009 - 08:13
User Badges:

Yes, I've seen that site, but I believe that only explains the first scenario in my post (i.e. Different MAC addresses showing up in the messages).


If this does explain the second scenario, I must be missing something, and I was hoping someone could explain.


Thanks.

jorge.calvo Tue, 03/10/2009 - 16:38
User Badges:
  • Bronze, 100 points or more

Hi,


As s.helmer said. This situation occurs if you have access points where the clients are roamming. Is this the case?

c2jkeegan Tue, 03/10/2009 - 16:45
User Badges:

This is not the case, No APs involved.


As I mentioned in my post the loop was caused by a system with two NICs and the other ports were just normal access ports with either a host, a host and phone or just a phone attached to them.

Sebastian Helmer Wed, 03/11/2009 - 12:58
User Badges:
  • Silver, 250 points or more

Maybe it would help to give us a short overview which device is connected to which port..

Actions

This Discussion