Strange mac address with prefix 0C:CC:01 & 0C:CC:01

hfma_hk09 · ‎03-30-2009

I found that my C4507 switch has received huge of HOSTFLAPPING with the prefix 0C:CC:01 & 0C:CC:01 :

C4507#show log

1378604: Mar 27 18:30:01.959 : %C4K_EBM-4-HOSTFLAPPING: Host 0C:CC:01:00:0C:CC in vlan 10 is flapping between port Gi5/1 and port Gi5/2

1378605: Mar 27 18:30:01.959 : %C4K_EBM-4-HOSTFLAPPING: Host 0C:00:01:00:0C:00 in vlan 10 is flapping between port Gi5/1 and port Gi5/2

1378606: Mar 27 18:30:32.442 : %C4K_EBM-4-HOSTFLAPPING: Host 0C:CC:01:00:0C:CC in vlan 10 is flapping between port Gi5/1 and port Gi5/2

1378607: Mar 27 18:30:32.442 : %C4K_EBM-4-HOSTFLAPPING: Host 0C:00:01:00:0C:00 in vlan 10 is flapping between port Gi5/2 and port Gi5/1

1378608: Mar 27 18:30:41.303 : %C4K_EBM-4-HOSTFLAPPING: Host 0C:CC:01:00:0C:CC in vlan 10 is flapping between port Gi5/2 and port Gi5/1

1378609: Mar 27 18:31:02.830 : %C4K_EBM-4-HOSTFLAPPING: Host 0C:CC:01:00:0C:CC in vlan 10 is flapping between port Gi5/2 and port Gi5/1

1378658: Mar 27 18:40:11.053 : %C4K_EBM-4-HOSTFLAPPING: Host 0C:00:01:00:0C:00 in vlan 10 is flapping between port Gi5/1 and port Gi5/2

Anyone know what is the meaning of these MAC addresses? I can't find the manufacturer for this prefix from web, please help..

Leo Laohoo · ‎03-30-2009

MAC address prefix 0C-CC-01 doesn't exist. The MAC address most likely belongs to a server with dual nics and not configured properly. You will need to trace this mac address all the way down to the switchport so you can take necessary actions.

rajivrajan1 · ‎03-30-2009

http://www.bradfordnetworks.com/CampusMgrArchive/1099.html

"We have the same issue every now an again. I can almost guarantee you

that the individual is using a NIC with a Marvel Yukon chipset. For some

reason the NIC advertises this second "rogue" MAC every now and again. "

A simple driver upgrade should fix the problem.

hfma_hk09 · ‎03-30-2009

Thanks, leolaohoo. I have traced these mac addresses down to switchport, and the 3750-1 & 3750-2 are both connecting to the previous C4507, but I find the following strange result, please take a look:

3750-1#show mac-address-table

Mac Address Table

-------------------------------------------

Vlan Mac Address Type Ports

---- ----------- -------- -----

10 0ccc.0100.0ccc DYNAMIC Gi1/0/8 <= connecting to C4507

10 0c00.0100.0c00 DYNAMIC Gi1/0/8 <= connecting to C4507

3750-2#show mac-address-table

Mac Address Table

-------------------------------------------

Vlan Mac Address Type Ports

---- ----------- -------- -----

10 0ccc.0100.0ccc DYNAMIC Fa1/0/1 <= connecting to Loadbalancer

10 0c00.0100.0c00 DYNAMIC Fa1/0/1 <= connecting to Loadbalancer

It seems the MAC addresses is sourced by the Loadbalancer, but it also showed in 3750-1 which is from C4507. I have checked the span-tree for that vlan, it seems there is no loop and works normal in the vlan...