Advice needed on log message

[martintonner]

Nov 16 02:55:05: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 674 times)

Packet received with invalid source MAC address (00:00:00:00:00:00) on port Gi7/

3 in vlan 20

I keep receiving this log message on a core switch which I have just upgraded to 12.2.25EWA3. When I trace the log through int g7/3 to one of our access switches, the mac address is not in the mac-address-table.

The log message is not present on the access switch, IOS 12.2.20EWA.

Anyone seen this type of message before and resolved the issue? I have tried the output interpreter but it didn't shed much light on the problem.

Regards,

Martin.

[amit-singh]

Hi Martin,

Nov 16 02:55:05: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 674 times)

Packet received with invalid source MAC address (00:00:00:00:00:00) on port Gi7/

3 in vlan 20

Explanation A packet was received with an all zero or a multicast source address. The packet is treated as invalid and no learning is done. Excessive flow of such packets can waste CPU cycles. This message is rate-limited and is displayed only for the first such packet received on any interface or VLAN. Subsequent messages will display cumulative count of all such packets received in given interval on all interfaces.

Recommended Action Check the switch configuration file to find the source of these packets on the specified port and take corrective action to fix them at the source end. You can also enable port security on that interface to shutdown the port if the incoming rate of packets with invalid source mac address is too high by issuing the "switchport port-security limit rate invalid-source-mac " command.

HTH,

-amit singh