Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

How can we stop these errors

%SYS-4-P2_WARN: 1/Invalid traffic from multicast source address 07:ae:00:02:d3:02 on port 1/2

I'm seeing lot of these errors on my 4006s, I know it is multicast mac address being the source address. CCO doesn't give enough information to troubleshoot this. Can anyone help?

Thanks.

3 REPLIES
Cisco Employee

Re: How can we stop these errors

Your best bet is to span 1/2 and capture a sniffer trace at the time that the messages appear.

Alternatively, if the messages always reference that same address, you might set up a capture filter on your sniffer for just that source mac, and let it run until you get a hit.

Hopefully the packet will have some identifying charachteristic (like an IP address or application port) that you'll be able to use to hunt down the source.

HTH,

Bobby

New Member

Re: How can we stop these errors

Bobby

Thanks for your answer. I'm getting this error at every 30 sec or less and not only to port 1/2 but also on 1/1. I'm suspecting a multicast issue because majority of errors appear with the multicast mac address. I had put the sniffer one time and when I chased these error only thing I could find was the muticast mac addres but not any real source IP or mac address.Do you think enabling multicast or an RP would help?

Thanks.

Cisco Employee

Re: How can we stop these errors

Enabling multicast or an RP won't help because, ultimately, the switch is complaining because it sees a frame with a src multicast MAC address as invalid.

I have seen cases where certain types of applications that communicate with other nodes (load balancers, firewalls, server clustering, etc.) will send heartbeats or hellos using a multicast source address.

If you have such devices in your network, you may want to check there. I did a search on the MAC address you referenced, but could not find anything that points to a specific application or vendor.

-Bobby

104
Views
0
Helpful
3
Replies