cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2520
Views
0
Helpful
2
Replies

Mac address 02:01:00:00:00:00 flaps between ports

My customer is replacing a 5500 with a 4006.When he does that he gets a lot of

%SYS-4-P2_WARN: 1/Host 02:01:00:00:00:00 is flap

ping between port 2/5 and port 3/19

So we removed config. Started afresh with spanning tree enabled on all the ports (no portfast). We have only one vlan with only one machine (directly connected) and one uplink to 5500. Still we see the error. I did a show cam dynamic and see the the mac address on both the ports.

The strange thing is that this does not look like a valid mac address (and is not the host mac address).

I searched all the vendor Id's and it looks like a 02:01:00 is not owned by any company.

So I put the host back on the 5500.5500 does not complain.

Anybody seen this problem

2 Replies 2

r.crist
Level 1
Level 1

That MAC addy is used by MS for Win2k server clusters doing network load balancing.. It's used for the heartbeat. Not sure why it would be flapping if only one device is connected, though. MAC addresses will flap if there are unterminated old Type-1A cables attached to the switch.

robho
Level 3
Level 3

The Cat5k will not notify with a log message. It will drop the CAM entry off the original port and add it to the new port where it learned it. On the other hand, the Cat4k will complain and log the message.

I'd physically check to see what are connected to those ports. And, see if somehow they are bridged together from an external device.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco