Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member


We have 4 ME3400s configured in a ring - 2 in Seattle & 2 at Brewster - we have 2 400GB Ethernet circuits  - circuit 1 connects to BRW1 & SEA1 to port G0/15 at each end and circuit 2 connects to BRW2 & SEA2 - BRW1 & BRW2 are also connected via ports G0/15.  BRW1 &BRW2 are connected via G0/13 and the same goes for SEA1 & SEA2.  Here is the entry we are seeing in the log - this is happening on 2 vlans 201 & 400:

%SW_MATM-4-MACFLAP_NOTIF: Host 0021.056b.bc1c in vlan 201 is flapping between port Gi0/13 and port Gi0/15.

Thanks in advance for your help!


Everyone's tags (3)
Cisco Employee


Hi Julie,

a sporadic mac address flapping is not a problem; if on the contrary you see the messages often there might be an underlying isue somewhere.

How often do you see the flapping?

Assuming that you see the flapping messages quite often it seem that your traffic is somehow looped within your ring. Considering that you don't mention any major issue (CPU up to the sky... protocols flapping and traffic dropped) I think that some traffic is sporadically looped.

Regarding the specific MAC address in vlan 201 0021.056b.bc1c the message says that traffic from that host is seen from local LAN port and from the WAN port. Of course that cannot be.

Where does that host reside exactly?

Have you checked whether your STP topology is coherent? One of the 4 switches (let's focus on vlan201) should be the root bridge for that vlan and the farthest one (2 hops away) should have a port in blocking state. If you check the outputs do you see one port in blocking state?

Can you check if you have increasing Topology changes in that vlan (show spann vlan 201 detail - you will see the number of TCs and the port a TC was received/triggered last - take the outputs multiple times to see if TCs increase).

About the WAN 400GB Ethernet link - which technology is that? Not sure how you can terminate a 400GB link on a ME3400 which does not have Terabit ports. Did you mean 400Mb maybe? If this is the case can you check if you have output drops on G0/15 of all the me3400? Likely you won't see any but it is better double check. If we have drops they will occur in your SP cloud where I suppose they configured a policer at 400Mb. Other assumption we need to verify is that if you have drops in the SP cloud some BPDU's are dropped too causing temporary reconvergences and TCs. During reconvergences it is quite normal that we see Mac flapping as it can happen that all ports are FWD. This is why you need to check TCs and STP status.

Also do you have stats regarding average throughtput on your Gi0/15 interfaces? Do you have peaks above the CIR your SP gives you?

Well, this might be a good start; depending on your answers we might do other checks.


Cisco Employee


This behavior indicates a possible network problem because the MAC  addresses move quickly from one port to another port before the default  aging time. The problem can be looping traffic on the network.

Try to locate where exactly is this host and where is should be connected.

Please have a look at this link. The troubleshooting steps might help you:



Please rate useful posts.