excessive inbound multicast

Unanswered Question
Nov 21st, 2009

Hi - new to Cisco here, and would like to get some thoughts from the group.  Hope I'm posting this in the right area.   I'm helping troubleshoot some strange network behavior, so any input to point me in the right direction would be appreciated given my newbie status with Cisco gear.   I've looked over all the configs and have been eyeing the spanning tree config as a potential cause.   I'm targeting each config line I come across and researching everything I don't know, but I have a lot to learn.  In the essence of timeliness, I'd also like to get some group input if possible.

Network is multiple 2950 & 3560's, single VLAN.   On multiple devices & ports, there is a constant 2.7-2.9Mbps inbound flow of constant broadcast traffic to the client.  This was detected through various tools, and verified in multiple Wireshark traces.  On most switches it is Sourcing from a Cisco MAC address and going to a destination of 01:00:0C:00:00:05 (multicast).   One one or two other switches, there is similar inbound traffic floods, but the source is an IPv6 address with a destination of FF02::16 - packet is a Multicast Listener Discovery message.  

Most of the switches are just operating in simple layer 2 mode and the ports are not configured with any spanning tree configuration at least from what I can tell from the running config, although most switches have a global command that states:

spannig-tree extend system-id

One of the core 3560's is in PVST mode, and trunking is enabled on all it's interfaces.

Only on one end user switch do I see spannig tree/portfast enabled on all ports.

I'm currently working on obtaining a physical connectivity map, but given the inbound flood of packets, does it sound like a STP misconfiguration is happening on our network?

Thank you!


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Giuseppe Larosa Sat, 11/21/2009 - 15:42

Hello J,

start by reading best practices for Cisco IOS switches


the mac address that you see is not listed among the well known ones.

I had thought of STP uplinkfast but it is reported as 01-00-0c-cd-cd-cd

ask also sh spanning-tree detail

it can provide last time STP has been executed so you can see if it is stable or not

Hope to help


rockymtnway Sat, 11/21/2009 - 16:38

Thanks for your post.   I will try that command, and am reading the best practices guide now.   If anyone else has any other comments, please feel free to post.   Thanks again.


This Discussion