%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET

[rolf.fischer_2]

Hi,

we frequently see this syslogmessage at our Catalyst 4000/4500 switches:

%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET Packet received with invalid source MAC address (45:00:05:DC:E1:05)

I do understand the meaning of the message but I don't understand why this MAC-Address is invalid. It's neither a groupaddress nor a local address, nor all-zero, so what's wrong with it?

Thank's in advance

Rolf

[pkhatri]

Hi Rolf,

The low-order bit of the first octet of the MAC address is designated the individual/group bit. If set to 1, it signifies that the address is a multicast e.g. the standard 01.00.5E.xx.xx.xx used for IP-to-EthternetMAC multicast addresses also sets it to 1. In the case of your MAC, the first octet is 45 or 01000101, so the last bit is 1, indicating that it's a multicast address. Since you are not allowed to have multicast MAC addresses as the source MAC, the frame is considered invalid.

Hope that helps - pls rate the post if it does.

Paresh

[rolf.fischer_2]

Paresh,

thanks for your response.

Actually I forgot that the lowest bits indicate i/g and u/l, so I was wrong when I said it's not a mc-address.

Is there any source to find out which application creates MAC-Addresses like this?

The Problem is that I see this message for several Ports so I don't know where exactly the source is.

Rolf

[pkhatri]

Hi Rolf,

I've never seen this particular address before. I suppose the only thing to do is to trace it through your switches - it's a painful process but I can't see what else you can do...

Paresh

[abhishek.chanana]

Hi Paresh ,

If the first octet is 00 then does it signify that its a individual machine , am i right ?if wrong then how to identify a individual machine

regards

[pkhatri]

Hi Abhishek,

If the first octet is an even (in decimal) number, then it is an individual address, not a group one. This is because the last bit set to 1 makes it odd.

Hope that helps - pls rate the post if it does.

Paresh

[abhishek.chanana]

Hi,

Correct me if i am wrong , you mean to say if the first octet is even ( in decimal number ) then its a individual machine and if the first octet is odd its a multicast address ,

regards

[pkhatri]

Yes, that is correct, Abhishek.

Paresh