03-08-2010 11:56 PM - edited 03-06-2019 10:03 AM
Hi,
%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 79 times)Packet received with invalid source MAC address (13:11:58:00:0C:00) on port Te1/1 in vlan 1
We get al lot of messages on the network. When we trace de logs from other switches we are stuck at the routers (6509).
There the messages disappear in the logs. What could this be?
switch1 --> switch2 --> switch3 --> catalyst6509_1 <-- switch4 <-- switch5 etc
|
switch6 --> switch7 --> switch8 --> catalyst6509_2 <-- switch9 <-- switch10 etc
How can we solve this? I cannot pin point the source of this mac address.
Thx,
Marc
03-09-2010 12:04 AM
Hello Marc,
the MAC address is considered not a valid source MAC adddress because it is a multicast MAC address
13:11:58:00:0C:00
13 means less significant bit of first byte set to 1 and this is I/G bit the first to go on wire.
To be noted that this kind of MAC addresses don't enter in the CAM table so it is not possible to trace them ( to find physical ports where they are learned).
Are there installed virtual servers of any type?
For example VMware instances created but not configured generate frames with source = all 0 that are considered not valid.
Other possible sources of strange source MAC addresses have been reported as IPv6 stacks for example on recent windows systems.
Hope to help
Giuseppe
03-09-2010 12:38 AM
Hi,
There are vmware machines in the network. But we do not see mac addresses with all 0. So there is no option to find the source of this mac address?
Thx,
Marc
03-09-2010 02:23 AM
Hello Marc,
unfortunately, as far as I know, these MAC addresses are not really learned and so they are not placed in the CAM table, as a result of this, it is not possible to locate them.
I tried many times but I was not able to.
Hope to help
Giuseppe
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide