Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET errors on 4900

feb 19 23:35:16.052 CET: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 17 times)Packet received with invalid source MAC address (09:23:3C:00:00:00) on port Gi3/15 in vlan 80
feb 20 23:35:28.923 CET: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 26 times)Packet received with invalid source MAC address (0D:1B:3B:00:00:00) on port Gi3/15 in vlan 80
feb 21 23:35:44.296 CET: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 33 times)Packet received with invalid source MAC address (9D:43:39:00:00:00) on port Gi3/15 in vlan 80
feb 22 23:35:52.990 CET: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 27 times)Packet received with invalid source MAC address (4D:4C:37:00:00:00) on port Gi3/15 in vlan 80
feb 23 23:36:25.716 CET: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 14 times)Packet received with invalid source MAC address (07:16:3B:00:00:00) on port Gi3/15 in vlan 80
feb 24 23:38:31.331 CET: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 23 times)Packet received with invalid source MAC address (07:E1:31:00:00:00) on port Gi3/15 in vlan 80
feb 25 23:37:15.222 CET: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 24 times)Packet received with invalid source MAC address (07:E1:31:00:00:00) on port Gi3/15 in vlan 80
feb 26 23:36:58.742 CET: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 26 times)Packet received with invalid source MAC address (09:1D:3B:00:00:00) on port Gi3/15 in vlan 80
feb 27 23:39:18.649 CET: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 15 times)Packet received with invalid source MAC address (07:E1:31:00:00:00) on port Gi3/15 in vlan 80

Everyone's tags (1)
4 REPLIES
Cisco Employee

%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET errors on 4900

Hi Makarand,

All these MAC addresses are multicast (i.e. group) MAC addresses, and therefore should never be used as a source MAC. Obviously, some device on your VLAN 80 is generating frames with a malformed source MAC address. Sadly, there is no easy way to find out where that device is located - you will only have to follow the indication about physical ports where this invalid MAC addresses was detected. In your case, it is Gi3/5.

Best regards,

Peter

%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET errors on 4900

Juuuuuuuuust curious, how did you know they were an multicast address?   I searched for one MAC and its coming up with nothing.  We are just starting multicast in my ccnp study.

Cisco Employee

%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET errors on 4900

Hi Jimmy,

how did you know they were an multicast address

By their first octet - it is an odd number. Recall that the first octet of a MAC address has two special reserved bits. The least significant bit is the I/G (Individual/Group) bit. If set to 1, making the first octet an odd number, the MAC address is a group MAC address. If you have a close look at the first octet of all these MAC addresses: 0x09, 0x0D, 0x9D, 0x4D, 0x07, the lowest bit is always set to 1. That makes the MAC address to be a group, or multicast, address.

Just for the sake of completeness, the second reserved bit I spoke about is the second least significant bit of the first octet, and is termed as the U/L bit (Universal/Local). All officially assigned MAC address OUIs have the U/L bit set to 0. Setting the U/L bit to 1 should indicate that the particular MAC address is not officially registered and instead it has been generated unofficially (a private MAC address if you'd like).

Best regards,

Peter

Re: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET errors on 4900

Thank you, researched your answer, you as usual, are always correct and equally as usual, informative.

http://en.wikipedia.org/wiki/Organizationally_unique_identifier

The OUI is normally discussed and represented as a set of octets in hexadecimal notation separated by dashes (i.e., FF-FF-FF) or as a set of octets separated by colons in bit-reversed notation (i.e., FF:FF:FF).[1]

The two least-significant-bits of the second nibble of the first octet of the hexadecimal representation (i.e., the two least significant bits of the first octet) of the OUI are reserved as flag bits for some protocols (e.g., 'M' bit and 'X' bit), flags to indicate whether the address is part of an individual (unicast) or group (multicast) address block (e.g., Individual / Group [I / G] bit or Unicast / Multicast [U / M] bit), flags to indicate whether an address is universally or locally administered (e.g., Universal / Local [U / L] bit), etc., and should not contain the values 1,2,3,5,6,7,9,a, b,d, e, or f, unless these values reflect the true meaning of these flag bits – if the organization that owns the OUI does set one of these bits when creating an identifier, then the value of the second nibble of the first octet changes accordingly in representations of the OUI (e.g., if the hexadecimal value of the second nibble of the first octet is 'C' and the least-significant-bit is set, then the value becomes 'D').

File:MAC-48 Address.svg

1630
Views
5
Helpful
4
Replies