two different MAC addresses on the same switchport

[david.tran]

I have Catalyst 3750 running IOS version c3750-ipservicesk9-mz.122-55.SE.bin.  I have an access port that connects to a Redhat Linux version 5.4 64 bits machine.  When I perform a "show mac address-table interface g1/0/3" where the redhat machine is connected to, I see two mac addresses on this access port.  One of the mac addresses, 0025.9006.4898,  belongs the the redhat machine.  the other mac address, I have no idea where it comes from.  I tried to perform clear mac address-table dynamic g1/0/3 several times but it does not help either.

Anyone knows why I am seeing two different mac addresses on the same swithport?

Thanks in advance.

lab-sw-2#sh mac address-table interface g1/0/3

          Mac Address Table

-------------------------------------------

Vlan    Mac Address       Type        Ports

----    -----------       --------    -----

102    0025.9006.4898    DYNAMIC     Gi1/0/3

102    0025.9006.5214    DYNAMIC     Gi1/0/3

Total Mac Addresses for this criterion: 2

lab-sw-2#sh run int g1/0/3

Building configuration...

Current configuration : 163 bytes

!

interface GigabitEthernet1/0/3

description lab-redhat-1 eth0

switchport access vlan 102

switchport mode access

load-interval 30

spanning-tree portfast

end

lab-sw-2#

[root@lab-redhat-1 ~]# ifconfig eth0

eth0      Link encap:Ethernet  HWaddr 00:25:90:06:48:98

          inet addr:192.168.102.70  Bcast:192.168.102.255  Mask:255.255.255.0

          inet6 addr: fe80::225:90ff:fe06:4898/64 Scope:Link

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:3581105468 errors:0 dropped:0 overruns:0 frame:0

          TX packets:2489505175 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000

          RX bytes:3721933991651 (3.3 TiB)  TX bytes:390872942328 (364.0 GiB)

          Memory:fbae0000-fbb00000

[root@lab-redhat-1 ~]#

[manju.cisco]

Hi David,

Did you try checking what IP address both mac-address shows using "show ip arp" command?

Do you have any virtual machine on your server ?

Regards,

Manjunath

[sachin_sharma0021]

Hello David,

Do you have use teaming on your server ?

[david.tran]

To answer both of your questions:

- This redhat Linux machine is behind a firewall and only one MAC address is show up in the firewall ARP table:

[fw-1]# arp -an | grep 192.168.102.70

? (192.168.102.70) at 00:25:90:06:48:98 [ether] on eth3.102

[fw-1]# arp -an | grep 52:14

[fw-1]#

- I installed and managed this redhat Linux machine,

- No I do not have any virtual machines running on this Redhat Linux machine,

- No I do not use NIC teaming on this redhat Linux machine,

[cadet alain]

Hi,

if you've got a SVI for vlan 102 then you can ping 192.168.102.255 and look at the arp cache if you get many replies

or you can sniff your NIC on the linux box with tcpdump and save as cap file

Regards.

Alain

[david.tran]

vlan 102 is not a routable vlan on the switch.  layer-3 for vlan 102 is a firewall.  What you suggested I already did before posting question in the forum:

- peform a flood ping from the firewall:  fping -g 192.168.102.0/24

- run "tcpdump -e -nnni eth0 | grep 52:14" on the linux server to capture traffics

I still can not find where this mac address 0025.9006.5214 comes from. 

[Mandlenkosi Nkiwane]

That MAC adddress is coming from a Super Micro server at least that is a start for you.

[david.tran]

did I mention that I built and maintained that Linux server ?  I know it is a Super Micro Server. 

I think I have an idea as to why I am seeing that MAC address.  I think it is related to the DRAC/ILOM interface.  With the DELL Enterprise DRAC uses separate LAN ports and add-in PCB but the low cost version does not.  I suspect this is it but I will check a few more things to make sure that is the case.

[Marvin Rhoads]

The racadm utility on your Dell server should be able to tell you the MAC address used by the DRAC interface. Documentation here.