cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1279
Views
0
Helpful
5
Replies

%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET

Tshi M
Level 5
Level 5

Has anyone actually resolved this type of error:

Aug 30 13:11:46.708 CDT: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 63 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Gi1/47 in vlan 225

I found something on the web but that was not very helpful.

Thanks,

5 Replies 5

Jagdeep Gambhir
Level 10
Level 10

Explanation:

A packet was received with an all zero or a multicast source address. The packet is treated as invalid and no learning is done. Excessive flow of such packets can waste CPU cycles. This message is rate-limited and is displayed only for the first such packet received on any interface or VLAN. Subsequent

messages will display cumulative count of all such packets received in given interval on all interfaces.

Recommended Action:

Check the switch configuration file to find the source of these packets on the specified port and take corrective action to fix them at the source end.

You can also enable port security on that interface to shutdown the port if the incoming rate of packets with invalid source mac address is too high by issuing the switchport port-security limit rate invalid-source-mac command.

Hi jgambhir,

That is the explanation I found on the Net as well. I was wondering if someone actually witnessed such message and fixed. Thanks for the reply...

i think the problem is in the PC connected to this port. may be there is a virus generating these frames

1-make sure your PC is free from viruses

2- or try to capture packets coming from this PC and see what r the destination IP/port in order to identify the source of this traffic

ahmed.yacoob
Level 1
Level 1

Can i issue this command on a trunk port

switchport port-security limit rate invalid-source-mac command

Tshi M
Level 5
Level 5

Anyone ever solved this issue? Cisco recommendation is not helpful as i am seeing this issue at another location and it is being reported on a Layer 2 uplink.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco