MLS question - expert advice needed

[situwayne]

I have 15 cat5k closet switches trunk to 2 distribution cat5ks. the 2 distribution switches are trunk to one another via 4 link etherchannel. all 15 closet switches are forwarding to one distribution switch and blocking to the other. (typical recommended design with dual links). I don't believe there are loops on the network. I start seeing the below messages on all the switches. Then I discovered a bad port on a trunk link between the 2 distribution switches. After shutdown that port and removed it from etherchannel group, these messages gone away.

Only 2 days later, these messages reoccur and flooded my syslog server. After some troubleshooting, I decided to disable mls on the distribution switches (see below url: cisco said if you see these message after disabling mls, call TAC). these message no longer show up after disabling mls. I decided to re-enable mls. What is interesting is I no longer see these messages after re-enabling mls. The other mystery is I am continue to see these messages on all other switches until I disable and re-enable mls.

What is going on here????

http://www.cisco.com/en/US/customer/products/hw/switches/ps679/products_tech_note09186a0080143d13.shtml#subtopic1i

2006 Jul 23 12:17:11 pdt -07:00 %MLS-4-RESUMESC:Resume MLS after detecting too many moves

2006 Jul 23 12:17:11 pdt -07:00 %MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(40000000)

2006 Jul 23 12:17:16 pdt -07:00 %MLS-4-RESUMESC:Resume MLS after detecting too many moves

2006 Jul 23 12:17:16 pdt -07:00 %MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(40000000)

2006 Jul 23 12:17:21 pdt -07:00 %MLS-4-RESUMESC:Resume MLS after detecting too many moves

2006 Jul 23 12:17:21 pdt -07:00 %MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(40000000)

2006 Jul 23 12:17:26 pdt -07:00 %MLS-4-RESUMESC:Resume MLS after detecting too many moves

2006 Jul 23 12:17:26 pdt -07:00 %MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(40000000)

2006 Jul 23 12:17:31 pdt -07:00 %MLS-4-RESUMESC:Resume MLS after detecting too many moves

2006 Jul 23 12:17:31 pdt -07:00 %MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(40000000)

2006 Jul 23 12:17:36 pdt -07:00 %MLS-4-RESUMESC:Resume MLS after detecting too many moves

2006 Jul 23 12:17:36 pdt -07:00 %MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(40000000)

2006 Jul 23 12:17:41 pdt -07:00 %MLS-4-RESUMESC:Resume MLS after detecting too many moves

2006 Jul 23 12:17:41 pdt -07:00 %MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(40000000)

[fmeetz]

Root cause is commonly due to the presence of two devices with the same MAC address actually connected to a VLAN.Use the show mls notification and show looktable commands on the switch to point you in the right direction of the duplicate MAC address or a possible physical loop.

[globalnettech]

Hello,

in order to just get rid of the messages (to clean up your syslogging), you can use the command:

set logging level mls 3 default

This will cause the switches to not log these messages anymore.

Not sure if you have seen the Cisco explanation of this message yet, anyway here is the link:

%MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec

http://www.cisco.com/warp/public/473/180.html#subtopic1i

Regards,

GNT

[Roberto Salazar]

The message means that the same mac-address was learned on two different ports. the questions is which ports, and why? Maybe a loop? finding the mac-address that flapped between two ports is the key, here is the procedure on how to track it down:

Step 1 Type "show mls notification", this will give you something like:

0: (0005f9df-00020180) Noti Chg TA 1f9df OI 180 V 1

1: (0005f9df-00020180) Noti Chg TA 1f9df OI 180 V 1

2: (0005f9df-000202c0) Noti Chg TA 1f9df OI 2c0 V 1

3: (0005f9df-00020180) Noti Chg TA 1f9df OI 180 V 1

note these fields^^^^^^^ ^^^ ^

What does return ?

This mac address is seen looping and may be traced to the root of the problem.

Step 2 Type "show looktable " to see the cam entry

For example,

"show looktable 1f9df" gives you:

Table address: 0x1f9df, Hash: 0x3f3b, Page: 7

Data: 0xc361d5f0 0x00100000 0x7e008000 0x00c00000

Parity1 SwGrp1 Entry Mac Address Vlan

0 0 00-00-0c-36-1d-5f 1

Fab AgeByte C-Mask S H L - T S V

0 fc 0 0 0 0 0 0 1

Parity2 SwGrp2 Port Index Router Xtag QOS

0 0 180 0 0

The mac address causing the move is 00-00-0c-36-1d-5f

Now you can do a show cam 00-00-0c-36-1d-5f and see from which port you had the "too many

move message"

Hope it will help.

Please rate helpful posts.

[situwayne]

Thanks everyone for your inputs.

Especially to Roberto's detail clarification.