invalid source MAC address (00:00:00:00:00:00)

Unanswered Question
May 7th, 2010

%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 1 times)Packet received with invalid source MAC address (00:00:00:00:00:00)

Latelly I been seeing the following syslog messages...after a quick google search it could be related to ESX VMWare.  Anyone seen this before?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Average Rating: 0 (0 ratings)
jbrenesj Fri, 05/07/2010 - 14:41

Yes, when the switch (mainly 4500 because other platforms don´t even have the log to report such condition) receives frames with one of the following MAC addreses as "source"

- Broadcast

- Multicast

- 0000.0000.0000

It reports the condition and drops the frame, nothing to be worried about.

I have seen it several times with different applications generating these frames, BTW it´s hard to capture these on wireshard unless you sniff the cable with a hub or something. I remember a couple of times Checkpoint was running some protocoll with virtual addreses and my switch saw the condition, another time was ESX

It´s annoying to have your loggs full of these but unless you know which server/device is generating the frames can´t really find out easily

Giuseppe Larosa Sat, 05/08/2010 - 02:26

Hello opers13,

>> Anyone seen this before?

Yes, my understanding is that when vmware instances are started and left unconfigured they originate frames with all 0 source address

We see these messages from time to time in our server farms

So after server people finish configuration of the vmware instance it should stop to appear

Hope to help

Giuseppe

opers13 Sat, 05/08/2010 - 02:39

Giuseppe,

thank you.  Funny thing is that I see the "invalid source MAC address (00:00:00:00:00:00)" syslog on my 4500s only and nothing on my 6509VEs.

Giuseppe Larosa Sat, 05/08/2010 - 03:02

Hello Opers13,

being an invalid source MAC the frame is dropped so devices not directly connected to servers should not complain of this

Also, other devices may have a different severity level for this event

Hope to help

Giuseppe

Actions

Login or Register to take actions

This Discussion

Posted May 7, 2010 at 9:56 AM
Stats:
Replies:4 Avg. Rating:
Views:15643 Votes:0
Shares:0

Related Content

Discussions Leaderboard

Rank Username Points
1 15,007
2 8,150
3 7,725
4 7,083
5 6,742
Rank Username Points
165
82
69
65
55