invalid source MAC address (00:00:00:00:00:00)

Unanswered Question
May 7th, 2010
User Badges:

%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 1 times)Packet received with invalid source MAC address (00:00:00:00:00:00)


Latelly I been seeing the following syslog messages...after a quick google search it could be related to ESX VMWare.  Anyone seen this before?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
jbrenesj Fri, 05/07/2010 - 14:41
User Badges:
  • Silver, 250 points or more

Yes, when the switch (mainly 4500 because other platforms don´t even have the log to report such condition) receives frames with one of the following MAC addreses as "source"


- Broadcast

- Multicast

- 0000.0000.0000


It reports the condition and drops the frame, nothing to be worried about.

I have seen it several times with different applications generating these frames, BTW it´s hard to capture these on wireshard unless you sniff the cable with a hub or something. I remember a couple of times Checkpoint was running some protocoll with virtual addreses and my switch saw the condition, another time was ESX

It´s annoying to have your loggs full of these but unless you know which server/device is generating the frames can´t really find out easily

Giuseppe Larosa Sat, 05/08/2010 - 02:26
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello opers13,


>> Anyone seen this before?


Yes, my understanding is that when vmware instances are started and left unconfigured they originate frames with all 0 source address


We see these messages from time to time in our server farms


So after server people finish configuration of the vmware instance it should stop to appear


Hope to help

Giuseppe

opers13 Sat, 05/08/2010 - 02:39
User Badges:

Giuseppe,


thank you.  Funny thing is that I see the "invalid source MAC address (00:00:00:00:00:00)" syslog on my 4500s only and nothing on my 6509VEs.

Giuseppe Larosa Sat, 05/08/2010 - 03:02
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Opers13,


being an invalid source MAC the frame is dropped so devices not directly connected to servers should not complain of this


Also, other devices may have a different severity level for this event


Hope to help

Giuseppe

Actions

This Discussion

Related Content