invalid source MAC address (00:00:00:00:00:00)

[opers13]

%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 1 times)Packet received with invalid source MAC address (00:00:00:00:00:00)

Latelly I been seeing the following syslog messages...after a quick google search it could be related to ESX VMWare.  Anyone seen this before?

[jbrenesj]

Yes, when the switch (mainly 4500 because other platforms don´t even have the log to report such condition) receives frames with one of the following MAC addreses as "source"

- Broadcast

- Multicast

- 0000.0000.0000

It reports the condition and drops the frame, nothing to be worried about.

I have seen it several times with different applications generating these frames, BTW it´s hard to capture these on wireshard unless you sniff the cable with a hub or something. I remember a couple of times Checkpoint was running some protocoll with virtual addreses and my switch saw the condition, another time was ESX

It´s annoying to have your loggs full of these but unless you know which server/device is generating the frames can´t really find out easily

[afsharki2]

This is happening 100k times a day for me at 6am every day, then usually 6hrs later again.  It's filling up my logs on my 4500x.  My 4500x, which is my distribution switch has a downstream access switch (3750) that is causing this.  Just like you said the 3750 access switch will not log it, but the 4500x will log it and point to the port-channel of that 3750 switch downstream along with what vlan it is.  The problem is that downstream switch is a stack of 5 switches and all i know is the vlan; i don't know the ethernet port since it's being logged on the 4500x dist switch.  This 3750 switch is just for end users to connect their computers; there are no vmware esx hosts or servers or anything complicated; just a bunch of voip phones and computers.  I just dont know how to track who's doing this. 

[Giuseppe Larosa]

Hello opers13,

>> Anyone seen this before?

Yes, my understanding is that when vmware instances are started and left unconfigured they originate frames with all 0 source address

We see these messages from time to time in our server farms

So after server people finish configuration of the vmware instance it should stop to appear

Hope to help

Giuseppe

[opers13]

Giuseppe,

thank you.  Funny thing is that I see the "invalid source MAC address (00:00:00:00:00:00)" syslog on my 4500s only and nothing on my 6509VEs.

[Giuseppe Larosa]

Hello Opers13,

being an invalid source MAC the frame is dropped so devices not directly connected to servers should not complain of this

Also, other devices may have a different severity level for this event

Hope to help

Giuseppe