Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(40000000)

would anyone happen to know what sort of problems this could lead to ? a ISP we support, in one of the switch they tie into is generating

2004 Jan 06 15:20:23 %MLS-4-RESUMESC:Resume MLS after detecting too many moves

2004 Jan 06 15:20:23 %MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(40000000)

which I found out some users are sending bogus mac address info,

VLAN Dest MAC/Route Des [CoS] Destination Ports or VCs / [Protocol Type]

---- ------------------ ----- -------------------------------------------

100 00-00-00-00-00-00 3/1 VCD:354 VPI:1 VCI:354 Type: AAL5SNAP PVC [ALL]

300 00-00-00-00-00-00 3/1 VCD:1729 VPI:2 VCI:755 Type: AAL5SNAP PVC [ALL]

300 00-00-00-00-00-00 3/1 VCD:1731 VPI:2 VCI:757 Type: AAL5SNAP PVC [ALL]

could issues like this lead to problem such as 99% CPU usage on the switch layer as well as on the ATM module side as well ?

3 REPLIES
VIP Purple

Re: MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(400000

Hello,

this is the official Cisco explanation:

%MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec

Problem: Sporadic or constant %MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec syslog messages are generated on the switch.

Description: The following is an example of the syslog output you will see when this error occurs:

%MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(20000000)

%MLS-4-RESUMESC:Resume MLS after detecting too many moves

%MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(20000000)

%MLS-4-RESUMESC:Resume MLS after detecting too many moves

These syslog messages indicate that the switch is relearning one or more MAC addresses on multiple ports in rapid succession. For example, on an access switch with two uplinks to the core of the network, the switch might learn a given MAC address first on one uplink and then on the other very rapidly.

If you see these messages infrequently, it is most likely a transitory L2 (spanning-tree) loop, resulting in packet flooding in one or more VLANs.

If you are seeing an excessive number of these messages (for example, if your syslog server log file or your switch console are being flooded with these messages), the problem might be due to the following reasons:

a permanent L2 (spanning-tree) loop

one or more faulty switch ports

a bad cable (for example, a unidirectional fiber link)

other bad hardware (not necessarily on the switch generating the messages)

misconfigured device (for example, a traffic generator sending traffic to two switch ports using the same MAC address)

If you are confident that there is no L2 loop or faulty hardware, you are not using MLS on the switch, and you want to eliminate these messages, you can disable MLS on the switch by issuing the set mls disable command. Alternately, you can modify the logging level for the MLS facility to three or lower by issuing the set logging level mls 3 default command . However, these solutions simply mask the problem.

If you get these messages after issuing the set mls disable command, open a case with the Cisco Technical Assistance Center (TAC).

here is what the Error Message Decoder says:

%MLS-4-RESUMESC: Resume MLS after detecting too many moves

This message indicates that MLS has resumed after being stopped due to too many Layer 2 source address changes being detected in a short period of time.

Recommended Action: No action is necessary. This message is provided for information only.

---

%MLS-4-MOVEOVERFLOW: Too many moves, stop MLS for [dec] sec ([hex])

This message indicates that there have been too many Layer 2 source address changes during a short period of time. This message might be caused by topology changes or spanning tree loops. MLS is stopped for a specified number of seconds and all entries are purged. [dec] is the number of seconds and [hex] is the event code for moves.

Recommended Action: Check the topology for any loops. Call your technical support representative.

HTH,

GP

New Member

Re: MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(400000

Hi Mike,

Did you issue a command to get the output posted here?

Thanks,

Erik.

New Member

Re: MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(400000

Hi Erik, yes i did. from the Edge Cat do a

show cam 00-00-00-00-00-00

Cheers

210
Views
0
Helpful
3
Replies
CreatePlease login to create content