cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1287
Views
0
Helpful
3
Replies

Strange mac address with prefix 0C:CC:01 & 0C:CC:01

hfma_hk09
Level 1
Level 1

I found that my C4507 switch has received huge of HOSTFLAPPING with the prefix 0C:CC:01 & 0C:CC:01 :

C4507#show log

1378604: Mar 27 18:30:01.959 : %C4K_EBM-4-HOSTFLAPPING: Host 0C:CC:01:00:0C:CC in vlan 10 is flapping between port Gi5/1 and port Gi5/2

1378605: Mar 27 18:30:01.959 : %C4K_EBM-4-HOSTFLAPPING: Host 0C:00:01:00:0C:00 in vlan 10 is flapping between port Gi5/1 and port Gi5/2

1378606: Mar 27 18:30:32.442 : %C4K_EBM-4-HOSTFLAPPING: Host 0C:CC:01:00:0C:CC in vlan 10 is flapping between port Gi5/1 and port Gi5/2

1378607: Mar 27 18:30:32.442 : %C4K_EBM-4-HOSTFLAPPING: Host 0C:00:01:00:0C:00 in vlan 10 is flapping between port Gi5/2 and port Gi5/1

1378608: Mar 27 18:30:41.303 : %C4K_EBM-4-HOSTFLAPPING: Host 0C:CC:01:00:0C:CC in vlan 10 is flapping between port Gi5/2 and port Gi5/1

1378609: Mar 27 18:31:02.830 : %C4K_EBM-4-HOSTFLAPPING: Host 0C:CC:01:00:0C:CC in vlan 10 is flapping between port Gi5/2 and port Gi5/1

1378658: Mar 27 18:40:11.053 : %C4K_EBM-4-HOSTFLAPPING: Host 0C:00:01:00:0C:00 in vlan 10 is flapping between port Gi5/1 and port Gi5/2

Anyone know what is the meaning of these MAC addresses? I can't find the manufacturer for this prefix from web, please help..

3 Replies 3

Leo Laohoo
Hall of Fame
Hall of Fame

MAC address prefix 0C-CC-01 doesn't exist. The MAC address most likely belongs to a server with dual nics and not configured properly. You will need to trace this mac address all the way down to the switchport so you can take necessary actions.

http://www.bradfordnetworks.com/CampusMgrArchive/1099.html

"We have the same issue every now an again. I can almost guarantee you

that the individual is using a NIC with a Marvel Yukon chipset. For some

reason the NIC advertises this second "rogue" MAC every now and again. "

A simple driver upgrade should fix the problem.

Thanks, leolaohoo. I have traced these mac addresses down to switchport, and the 3750-1 & 3750-2 are both connecting to the previous C4507, but I find the following strange result, please take a look:

3750-1#show mac-address-table

Mac Address Table

-------------------------------------------

Vlan Mac Address Type Ports

---- ----------- -------- -----

10 0ccc.0100.0ccc DYNAMIC Gi1/0/8 <= connecting to C4507

10 0c00.0100.0c00 DYNAMIC Gi1/0/8 <= connecting to C4507

3750-2#show mac-address-table

Mac Address Table

-------------------------------------------

Vlan Mac Address Type Ports

---- ----------- -------- -----

10 0ccc.0100.0ccc DYNAMIC Fa1/0/1 <= connecting to Loadbalancer

10 0c00.0100.0c00 DYNAMIC Fa1/0/1 <= connecting to Loadbalancer

It seems the MAC addresses is sourced by the Loadbalancer, but it also showed in 3750-1 which is from C4507. I have checked the span-tree for that vlan, it seems there is no loop and works normal in the vlan...

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco