Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

%C4K_EBM-4-HOSTFLAPPING error message

Hello Experts,

I have an issue in my network where I see almost daily the following error message in one of my CORE switches:

Mar 6 11:15:38: %C4K_EBM-4-HOSTFLAPPING: Host 00:15:00:13:C9:5F in vlan 251 is flapping between port Gi2/2 and port Gi2/1

Mar 6 11:18:10: %C4K_EBM-4-HOSTFLAPPING: Host 00:15:00:13:C9:5F in vlan 251 is flapping between port Gi2/1 and port Gi2/2

I have identified the host with the MAC address 00:15:00:13:C9:5F which seems to be a PC with a wireless connection to one of my APs:

AP_PLT_DIRPROD_01#sh dot11 associations | i 0015.0013.c95f

0015.0013.c95f 4800-radio AP_PLT_DIRPROD_ self Assoc

I have spanning-tree disabled in VLAN 251 on the AP and I don't think this issue is due to a STP loop.

Do you think this could be due to a virus on that PC? Or what do you recommend to do?

Thanks a lot!!

Juan Pablo Corrales

Network Specialist


Re: %C4K_EBM-4-HOSTFLAPPING error message

What devices are connected to ports gi2/1 and 2/2?

Re: %C4K_EBM-4-HOSTFLAPPING error message

Here is the topology:

CORE (g2/1) - L2 SW - L2 SW - AP

| |- L2 SW - L2 SW - AP


| (g2/2) - L2 SW - L2 SW - AP - HOST with MAC

Re: %C4K_EBM-4-HOSTFLAPPING error message

There are Cisco switches and at the end of the chain there are APs.

The MAC address that appears in the error message is a host that is associated to an Access Point.

Re: %C4K_EBM-4-HOSTFLAPPING error message

It looks like the wireless user is roaming and associating with different AP at different times. Hardcoding the PC to associate with the same AP always is one way to get rid of the host flapping error message.



Re: %C4K_EBM-4-HOSTFLAPPING error message


Thanks a lot for the response. That's exactly what I'm thinking is happening.

Re: %C4K_EBM-4-HOSTFLAPPING error message

Hi Juan,

Personally don't think it could be related with virus on that PC.

This error message appears on the switch when the switch detects the specified host address as a source address on multiple ports.


The issue can occur due to Spanning Tree Protocol (STP) loops in the network that cause packet drops from the specific host. In addition to packet drops, STP loops lead to several other symptoms, which are listed here:

·Loss of connectivity to, from, and through affected network regions.

·High link utilization (often 100 percent).

·High switch backplane utilization (compared to the baseline utilization).

·Syslog messages that indicate packet looping in the network (for example, HSRP duplicate IP address messages).

·Syslog messages that indicate constant address relearning or MAC address flapping messages.

·An increase in the number of output drops on many interfaces.


One or more of these symptoms independently can indicate different issues (or no issue at all). However, when you observe many of these symptoms at the same time, you must check whether a forwarding loop has developed in the network.