%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 79 times)Packet received with invalid source MAC address (13:11:58:00:0C:00) on port Te1/1 in vlan 1

[MJonkers]

Hi,

%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 79 times)Packet received with invalid source MAC address (13:11:58:00:0C:00) on port Te1/1 in vlan 1

We get al lot of messages on the network. When we trace de logs from other switches we are stuck at the routers (6509).

There the messages disappear in the logs. What could this be?

switch1 --> switch2 --> switch3 --> catalyst6509_1 <-- switch4 <-- switch5 etc

                                                                  |

switch6 --> switch7 --> switch8 --> catalyst6509_2 <-- switch9 <-- switch10 etc

How can we solve this? I cannot pin point the source of this mac address.

Thx,

Marc

[Giuseppe Larosa]

Hello Marc,

the MAC address is considered not a valid source MAC adddress because it is a multicast MAC address

13:11:58:00:0C:00

13 means less significant bit of first byte set to 1 and this is I/G bit the first to go on wire.

To be noted that this kind of MAC addresses don't enter in the CAM table so it is not possible to trace them ( to find physical ports where they are learned).

Are there installed virtual servers of any type?

For example VMware instances created but not configured generate frames with source = all 0 that are considered not valid.

Other possible sources of strange source MAC addresses have been reported as IPv6 stacks for example on recent windows systems.

Hope to help

Giuseppe

[MJonkers]

Hi,

There are vmware machines in the network. But we do not see mac addresses with all 0. So there is no option to find the source of this mac address?

Thx,

Marc

[Giuseppe Larosa]

Hello Marc,

unfortunately, as far as I know, these MAC addresses are not really learned and so they are not placed in the CAM table, as a result of this, it is not possible to locate them.

I tried many times but I was not able to.

Hope to help

Giuseppe