Unknown Mac address 000b.450d.000a

MMstre · ‎02-08-2010

I am trying to track down a packet that seems to be disappearing in our ditribution switch. The sniff shows a destination mac of 000b.450d.000a, however, i do not see this mac address anywhere in the switch. I am seeing the STP VLAN mac as 000b.450d.0000, so I am assuming that the 000a address is a product of STP, but i cannot confirm and am not sure how to find this.

Any help would be greatly appreciated.

Thanks,

Mike

Giuseppe Larosa · ‎02-08-2010

Hello Mike,

the OUI is a Cisco OUI

00-0B-45   (hex)          Cisco
000B45     (base 16)          Cisco
                    80 West Tasman Dr.
                    SJ-M/1
                    San Jose CA 95134
                    UNITED STATES

there are chances that the MAC address is used as source MAC address on a switch.

Sh module provide the block of consecutive MAC addresses available in a switch, see following example:

sh module
Mod Ports Card Type                              Model              Serial No.
--- ----- -------------------------------------- ------------------ -----------
2    8 8 port 1000mb GBIC Enhanced QoS        WS-X6408A-GBIC     SAD04330B90
3   24 24 port 100FX Multi mode               WS-X6324-100FX-MM SAD0606028J
4   48 48 port 10/100 mb RJ-45 ethernet       WS-X6248-RJ-45     SAD043209WM
5    2 Supervisor Engine 720 (Active)         WS-SUP720-BASE     SAD0753097P

Mod MAC addresses                       Hw    Fw           Sw           Status
--- ---------------------------------- ------ ------------ ------------ -------
2 0002.7e23.e574 to 0002.7e23.e57b   1.3   5.4(2)       8.5(0.46)RFW Ok
3 0001.6477.8e34 to 0001.6477.8e4b   3.5   5.4(2)       8.5(0.46)RFW Ok
4 00d0.d33c.28e8 to 00d0.d33c.2917   1.2   5.1(1)CSX    8.5(0.46)RFW Ok
5 000e.84e4.2dcc to 000e.84e4.2dcf   3.0   8.5(1)       12.2(18)SXF8 Ok

so it should be associated to one port of the switch.

the switch uses different MAC addresses for example as source of CDP, DTP frames and so on.

Hope to help

Giuseppe

Ganesh Hariharan · ‎02-08-2010

I am trying to track down a packet that seems to be disappearing in our ditribution switch. The sniff shows a destination mac of 000b.450d.000a, however, i do not see this mac address anywhere in the switch. I am seeing the STP VLAN mac as 000b.450d.0000, so I am assuming that the 000a address is a product of STP, but i cannot confirm and am not sure how to find this.

Any help would be greatly appreciated.

Thanks,

Mike

Hi Mike,

000a address can be mac of the switch for a particular vlan where a switch sends a BPDU frame using the unique MAC address of the port itself as a source address, and a destination address of the STP multicast address 01:80:C2:00:00:00.

Just check out and issue a command in switches which are connected show spanning-tree and check what is the mac addrsss of root brieg and own bridge id mac.

Hope to help

Ganesh.H

MMstre · ‎02-08-2010

So an unusual item that i have encountered is that a packet caputre shows ICMP replies with a destination address of 000b.450d.000a. The actual physical VLAN interface is 000b.450d.0000. The directly connected router is showing the HSRPvirtual MAC as the arp entry. So I am wondering if anyone has seen anything like this, where the connected router show the HSRP MAC, but the packets are using the phys vlan MAC...???