MAC address flapping on all switches

[codflanglers]

Since yesterday lunchtime we've been seeing multiple MAC address flaps on our switches.

We are seeing this on all switches, but only a few MAC addresses on each switch. We route between different areas so as to keep spanning tree to a minimum. It's a star design and we use etherchannel to eliminate spanning tree and loops.

We use different switch types and different IOS levels across switches so there is really nothing in common. We have not made any changes and this has all been working for years.

Any ideas?

[Rajeev Sharma]

Hey,

Best way is to pick any of the MAC's and locate its original location. And then follow the other path to check for any temporary STP loops or it might be STP TCN's.

HTH.

Regards,

RS.
 

[Walter Astori]

Do you have a Multicast address ? Do you have enabled proxy-arp ?

[codflanglers]

We use source specific multicast in each area and no proxy arp. Confirmed no loops. 

[Walter Astori]

Can you see which mac address flaps ? It is Multicast or anycast ?

[codflanglers]

The MAC address flaps seem to be PCs and it's not multicast traffic. Seemingly random ports. As I said the devices have been traced.

It is in every L2 vlan we use for PCs. These L2 boundaries are separated by L3 links. Almost like an infected machine in each L2 domain.

[codflanglers]

Think we've finally found the issue. Same as described here:

https://supportforums.cisco.com/discussion/11835361/mac-address-flapping-and-sccm-wake-proxy

Our problem coincides with a roll-out of wake on lan SCCM. Working with our desktop team to get this removed.