invalid source MAC address (00:00:00:00:00:00)

Unanswered Question
May 7th, 2010
User Badges:

%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 1 times)Packet received with invalid source MAC address (00:00:00:00:00:00)

Latelly I been seeing the following syslog messages...after a quick google search it could be related to ESX VMWare.  Anyone seen this before?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
jbrenesj Fri, 05/07/2010 - 14:41
User Badges:
  • Silver, 250 points or more

Yes, when the switch (mainly 4500 because other platforms don´t even have the log to report such condition) receives frames with one of the following MAC addreses as "source"

- Broadcast

- Multicast

- 0000.0000.0000

It reports the condition and drops the frame, nothing to be worried about.

I have seen it several times with different applications generating these frames, BTW it´s hard to capture these on wireshard unless you sniff the cable with a hub or something. I remember a couple of times Checkpoint was running some protocoll with virtual addreses and my switch saw the condition, another time was ESX

It´s annoying to have your loggs full of these but unless you know which server/device is generating the frames can´t really find out easily

Giuseppe Larosa Sat, 05/08/2010 - 02:26
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello opers13,

>> Anyone seen this before?

Yes, my understanding is that when vmware instances are started and left unconfigured they originate frames with all 0 source address

We see these messages from time to time in our server farms

So after server people finish configuration of the vmware instance it should stop to appear

Hope to help


opers13 Sat, 05/08/2010 - 02:39
User Badges:


thank you.  Funny thing is that I see the "invalid source MAC address (00:00:00:00:00:00)" syslog on my 4500s only and nothing on my 6509VEs.

Giuseppe Larosa Sat, 05/08/2010 - 03:02
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Opers13,

being an invalid source MAC the frame is dropped so devices not directly connected to servers should not complain of this

Also, other devices may have a different severity level for this event

Hope to help



This Discussion

Related Content