Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

why there are multicast entries in mac address table?. And mac flaps causing high CPU

First question is why i am seeing below multicast entries in mac address table for gi1/39, gernally on all interfaces in vlan 172.

cisco4k#sh mac address-table interface gi1/39     -----> connects to a VM

Unicast Entries

vlan   mac address     type        protocols               port

-------+---------------+--------+---------------------+--------------------

172    12f3.f000.3361   dynamic ip                    GigabitEthernet1/39  

Multicast Entries

vlan    mac address     type    ports

-------+---------------+-------+--------------------------------------------

172    ffff.ffff.ffff   system Switch,Gi1/35,Gi1/36,Gi1/37,Gi1/38,Gi1/39

                                Gi1/40,Gi1/41,Gi1/46,Po3,Po4

cisco4k#sh ip multicast                  

  Multicast Routing: disabled

  Multicast Multipath: disabled

  Multicast Route limit: No limit

  Multicast Triggered RPF check: enabled

  Multicast Fallback group mode: Sparse

cisco4k#sh ip multicast interface vlan 172

Vlan172 is up, line protocol is up

  Internet address is x.x.x.x/24

  Multicast routing: disabled

  Multicast packets in/out: 59324871/0

  Multicast boundary: not set

  Multicast TTL threshold: 0

  Multicast Tagswitching: disabled

cisco4k#sh ip multicast interface vlan 172

Vlan172 is up, line protocol is up

  Internet address is x.x.x.x/24

  Multicast routing: disabled

  Multicast packets in/out: 59324877/0

  Multicast boundary: not set

  Multicast TTL threshold: 0

  Multicast Tagswitching: disabled

ddcxs01an#

--------------------------------------------

Second Q - I am seeing MAC address flaps and also CPU high on switch , could this be related to multicast entries, i belive no, what you think

cisco4k#sh ver

Cisco IOS Software, Catalyst 4000 L3 Switch Software (cat4000-I5S-M), Version 12.2(25)EWA10, RELEASE SOFTWARE (fc1)

cisco4k#sh log | in 12:F3:F0:00:33:61

Aug 17 20:33:02 starts: %C4K_EBM-4-HOSTFLAPPING: Host 12:F3:F0:00:33:61 in vlan 172 is flapping between port Gi1/38 and port Gi1/39

cisco4k#sh mac address-table interface gi1/39

Unicast Entries

vlan   mac address     type        protocols               port

-------+---------------+--------+---------------------+--------------------

172    12f3.f000.3361   dynamic ip                    GigabitEthernet1/39  

Multicast Entries

vlan    mac address     type    ports

-------+---------------+-------+--------------------------------------------

172    ffff.ffff.ffff   system Switch,Gi1/35,Gi1/36,Gi1/37,Gi1/38,Gi1/39

                                Gi1/40,Gi1/41,Gi1/46,Po3,Po4

cisco4k#sh mac address-table interface gi1/38

Multicast Entries

vlan    mac address     type    ports

-------+---------------+-------+--------------------------------------------

172    ffff.ffff.ffff   system Switch,Gi1/35,Gi1/36,Gi1/37,Gi1/38,Gi1/39

                                Gi1/40,Gi1/41,Gi1/46,Po3,Po4

cisco4k#sh run int gi1/38

Building configuration...

Current configuration : 140 bytes

!

interface GigabitEthernet1/38

switchport access vlan 172

switchport mode access

logging event link-status

spanning-tree portfast

end

Current CPU is normal , as only one mac address is flapping ,I noticed a 99% cpu when there were multiple mac flaps for host in vlan 172, and PID 30 was using more than 80% cpu.

cisco4k#sh proc cpu sorted | ex 0.00

CPU utilization for five seconds: 24%/0%; one minute: 26%; five minutes: 27%

PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process

  30  39654906482251773658          0 16.79% 18.86% 19.14%   0 Cat4k Mgmt LoPri

  29  20350339682857418569          0  5.43%  5.57%  5.58%   0 Cat4k Mgmt HiPri

Everyone's tags (4)
3 REPLIES
Hall of Fame Super Silver

Re: why there are multicast entries in mac address table?. And

Hello Sandeep,

the I/G bit that decides if the address is multicast or unicast is the last significant digit on the most significant byte.

In your case the most significant byte is 0x12 this means  0001001>>0<<  this is still a valid unicast MAC address as the least significant digit is 0

As a result these should be unrelated to the high cpu usage you see on devices.

Use the following document to further investigate the high cpu issues

http://www.cisco.com/en/US/products/hw/switches/ps663/products_tech_note09186a00804cef15.shtml

>>This

show processes cpu

output shows that       there are two processes that use the CPU—

Cat4k Mgmt       HiPri

and

Cat4k Mgmt       LoPri

. These two processes aggregate multiple       platform-specific processes which perform the essential management functions on       the Catalyst 4500. >>>These processes process control plane as well as data       packets that need to be software-switched or processed.

Hope to help

Giuseppe

New Member

Re: why there are multicast entries in mac address table?. And

Giuseppe,

Thanks for you time and document....

I know I was not clear with describing my problem earlier in this discussion, but let me try to explain the real problem here agian.. :-)

Switch_A ---- Int Gi1/46 ==Trunk == Gi1/46 ------ Switch_B

           |                                                                     |

Hsrp Stby  Vlan172                                          HSRP active Vlan 172

           |                                                                     |

            ---------------  VM/Servers on LAN ------------

                              Eg: Host : 12f3.f000.3361

Switch_B#

Aug 19 14:59:07 starts: %C4K_EBM-4-HOSTFLAPPING: Host 12:F3:F0:00:33:61 in vlan 172 is flapping between port Gi1/46 and port Gi1/38

Aug 19 14:59:23 starts: %C4K_EBM-4-HOSTFLAPPING: Host 12:F3:F0:00:33:61 in vlan 172 is flapping between port Gi1/38 and port Gi1/39

Switch_A#sh mac address-table vlan 172

Unicast Entries

vlan   mac address     type        protocols               port

-------+---------------+--------+---------------------+--------------------

172    0000.0c07.ac01   dynamic ip                    GigabitEthernet1/46  

172    001d.450c.b93f   dynamic ip                    GigabitEthernet1/46  

172    001d.450c.c17f    static ip,ipx,assigned,other Switch               

172    12f3.f000.3361   dynamic ip                    GigabitEthernet1/38  

172    12f3.f000.5357   dynamic ip                    GigabitEthernet1/46  

  -------------------outupt cut---------------------

I tried to shut down the interface which were flapping one by one and still obeserved below:

Switch_B#

Aug 19 15:09:57 starts: %LINK-5-CHANGED: Interface GigabitEthernet1/38, changed state to administratively down

Aug 19 15:09:58 starts: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/38, changed state to down

Aug 19 15:09:58 starts: %SYS-5-CONFIG_I: Configured from console by sdfx on vty0 (192.168.100.100)

Aug 19 15:09:59 starts: %C4K_EBM-4-HOSTFLAPPING: Host 12:F3:F0:00:33:61 in vlan 172 is flapping between port Gi1/46 and port Gi1/39

Aug 19 15:10:11 starts: %C4K_EBM-4-HOSTFLAPPING: Host 12:F3:F0:00:33:61 in vlan 172 is flapping between port Gi1/39 and port Gi1/46

Aug 19 15:10:28 starts: %C4K_EBM-4-HOSTFLAPPING: Host 12:F3:F0:00:33:61 in vlan 172 is flapping between port Gi1/46 and port Gi1/39

Aug 19 15:10:43 starts: %C4K_EBM-4-HOSTFLAPPING: Host 12:F3:F0:00:33:61 in vlan 172 is flapping between port Gi1/39 and port Gi1/46

Aug 19 15:10:44 starts: %LINK-3-UPDOWN: Interface GigabitEthernet1/38, changed state to down

Aug 19 15:10:47 starts: %LINK-3-UPDOWN: Interface GigabitEthernet1/38, changed state to up

Aug 19 15:10:48 starts: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/38, changed state to up

Aug 19 15:10:50 starts: %LINK-5-CHANGED: Interface GigabitEthernet1/39, changed state to administratively down

Aug 19 15:10:50 starts: %SYS-5-CONFIG_I: Configured from console by sdfx on vty0 (192.168.100.100)

Aug 19 15:10:51 starts: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/39, changed state to down

Aug 19 15:10:51 starts: %C4K_EBM-4-HOSTFLAPPING: Host 12:F3:F0:00:33:61 in vlan 172 is flapping between port Gi1/46 and port Gi1/38

Aug 19 15:11:06 starts: %C4K_EBM-4-HOSTFLAPPING: Host 12:F3:F0:00:33:61 in vlan 172 is flapping between port Gi1/38 and port Gi1/46

I am not sure which port the Server or VM is connected because mac flaps make me crazy and confused, may be I need to verify this with server guys, but if there is any thing you can advise here, that will be very helpful.

Thanks again..

Sandeep.

Message was edited by: Sandeep Rawat (Corrected the switch names)

New Member

Re: why there are multicast entries in mac address table?. And

Hello,

MAC Movement is a common High CPU root cause for the switching platforms, in where the CPU will spend its time rewriting/updating MAC entries. This is a common issue when you have a STP instability in place. The CPU utilization will rise at any point when the problem is amplified and is spanning multiple ports. You should rather feel lucky that you have discovered the root cause to be specific with one server box rather than a complete L2 domain STP instabilities.

As of now, you should difinitly contact your server team to check for any NIC teaming (or similar config) abnormality, or any physical (interfaces, cables, adapters) problems. or maybe asking on why the VM(s) is/are changing the active port continuously? you can ask them to configur the VM to be assigned only one reserved physical interface as a proof of concept.

Cheers,

Tareq

4739
Views
0
Helpful
3
Replies
CreatePlease to create content