invalid source MAC address (00:00:00:00:00:00)

Unanswered Question
May 7th, 2010
User Badges:

%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 1 times)Packet received with invalid source MAC address (00:00:00:00:00:00)


Latelly I been seeing the following syslog messages...after a quick google search it could be related to ESX VMWare.  Anyone seen this before?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
jbrenesj Fri, 05/07/2010 - 14:41
User Badges:
  • Silver, 250 points or more

Yes, when the switch (mainly 4500 because other platforms don´t even have the log to report such condition) receives frames with one of the following MAC addreses as "source"


- Broadcast

- Multicast

- 0000.0000.0000


It reports the condition and drops the frame, nothing to be worried about.

I have seen it several times with different applications generating these frames, BTW it´s hard to capture these on wireshard unless you sniff the cable with a hub or something. I remember a couple of times Checkpoint was running some protocoll with virtual addreses and my switch saw the condition, another time was ESX

It´s annoying to have your loggs full of these but unless you know which server/device is generating the frames can´t really find out easily

afsharki2 Thu, 06/08/2017 - 15:30
User Badges:

This is happening 100k times a day for me at 6am every day, then usually 6hrs later again.  It's filling up my logs on my 4500x.  My 4500x, which is my distribution switch has a downstream access switch (3750) that is causing this.  Just like you said the 3750 access switch will not log it, but the 4500x will log it and point to the port-channel of that 3750 switch downstream along with what vlan it is.  The problem is that downstream switch is a stack of 5 switches and all i know is the vlan; i don't know the ethernet port since it's being logged on the 4500x dist switch.  This 3750 switch is just for end users to connect their computers; there are no vmware esx hosts or servers or anything complicated; just a bunch of voip phones and computers.  I just dont know how to track who's doing this. 

Giuseppe Larosa Sat, 05/08/2010 - 02:26
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello opers13,


>> Anyone seen this before?


Yes, my understanding is that when vmware instances are started and left unconfigured they originate frames with all 0 source address


We see these messages from time to time in our server farms


So after server people finish configuration of the vmware instance it should stop to appear


Hope to help

Giuseppe

opers13 Sat, 05/08/2010 - 02:39
User Badges:

Giuseppe,


thank you.  Funny thing is that I see the "invalid source MAC address (00:00:00:00:00:00)" syslog on my 4500s only and nothing on my 6509VEs.

Giuseppe Larosa Sat, 05/08/2010 - 03:02
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Opers13,


being an invalid source MAC the frame is dropped so devices not directly connected to servers should not complain of this


Also, other devices may have a different severity level for this event


Hope to help

Giuseppe

Actions

This Discussion

Related Content