Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

LACP: "Unknown packets rcvd" and "Illegal packets rcvd"?

While troubleshooting an issue on an N5K, we noticed the following values in the output of the "show lacp" command:


bld-vda-4a-d33231# sh lacp interf eth 125/1/9
  Unknown packets rcvd: 1303
  Illegal packets rcvd: 1303


We have not been able to find anything that specifically documents what constitutes either an Unknown or an Illegal packet.  Any help?

  • LAN Switching and Routing
Everyone's tags (1)

Hi,These counters are


These counters are documented in the IEEE 802.1AX standard as follows: aAggPortStatsUnknownRx

The number of frames received that either
 - Carry the Slow Protocols Ethernet Type value (IEEE Std 802.3 Annex 57A.4), but contain
an unknown PDU, or
 - Are addressed to the Slow Protocols group MAC Address (IEEE Std 802.3 Annex 57A.3),
but do not carry the Slow Protocols Ethernet Type. aAggPortStatsIllegalRx

- The number of frames received that carry the Slow Protocols Ethernet Type value (IEEE Std
802.3 Annex 57A.4), but contain a badly formed PDU or an illegal value of Protocol Subtype
(IEEE Std 802.3 Annex 57A.3).

The references to Annex 57A.3 and 57A.4 of the IEEE 802.3 standard simply mean frames that are sent with a destination MAC address of 01-80-C2-00-00-02 and an Ethernet type field value of 0x8809.

The above isn't overly helpful other than to tell you that the Nexus believes there's something in the LACPDU received from the neighbour that is not as per the standard.

I think the next step would be to capture the LACPDU received from the device attached to eth125/1/9 and try to figure out what's wrong with it. You should be able to capture the LACPDU with ethanalyzer using the following:

ethanalyzer local interface inbound-hi display-filter "eth.src == xx:xx:xx:xx:xx:xx and eth.dst == 01:80:c2:00:00:02" detail

Obviously replace xx:xx:xx:xx:xx:xx with the MAC address of the link partner.

As the interface is on a FEX then presumably it's connected to a server of some sort. Do you have more than one server connected in this way and if so are they all displaying the same behaviour? What's the OS type and NIC driver version?