Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET

Hi,

we frequently see this syslogmessage at our Catalyst 4000/4500 switches:

%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET Packet received with invalid source MAC address (45:00:05:DC:E1:05)

I do understand the meaning of the message but I don't understand why this MAC-Address is invalid. It's neither a groupaddress nor a local address, nor all-zero, so what's wrong with it?

Thank's in advance

Rolf

7 REPLIES
Purple

Re: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET

Hi Rolf,

The low-order bit of the first octet of the MAC address is designated the individual/group bit. If set to 1, it signifies that the address is a multicast e.g. the standard 01.00.5E.xx.xx.xx used for IP-to-EthternetMAC multicast addresses also sets it to 1. In the case of your MAC, the first octet is 45 or 01000101, so the last bit is 1, indicating that it's a multicast address. Since you are not allowed to have multicast MAC addresses as the source MAC, the frame is considered invalid.

Hope that helps - pls rate the post if it does.

Paresh

New Member

Re: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET

Paresh,

thanks for your response.

Actually I forgot that the lowest bits indicate i/g and u/l, so I was wrong when I said it's not a mc-address.

Is there any source to find out which application creates MAC-Addresses like this?

The Problem is that I see this message for several Ports so I don't know where exactly the source is.

Rolf

Purple

Re: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET

Hi Rolf,

I've never seen this particular address before. I suppose the only thing to do is to trace it through your switches - it's a painful process but I can't see what else you can do...

Paresh

New Member

Re: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET

Hi Paresh ,

If the first octet is 00 then does it signify that its a individual machine , am i right ?if wrong then how to identify a individual machine

regards

Purple

Re: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET

Hi Abhishek,

If the first octet is an even (in decimal) number, then it is an individual address, not a group one. This is because the last bit set to 1 makes it odd.

Hope that helps - pls rate the post if it does.

Paresh

New Member

Re: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET

Hi,

Correct me if i am wrong , you mean to say if the first octet is even ( in decimal number ) then its a individual machine and if the first octet is odd its a multicast address ,

regards

Purple

Re: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET

Yes, that is correct, Abhishek.

Paresh

316
Views
9
Helpful
7
Replies