Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

MLS question - expert advice needed

I have 15 cat5k closet switches trunk to 2 distribution cat5ks. the 2 distribution switches are trunk to one another via 4 link etherchannel. all 15 closet switches are forwarding to one distribution switch and blocking to the other. (typical recommended design with dual links). I don't believe there are loops on the network. I start seeing the below messages on all the switches. Then I discovered a bad port on a trunk link between the 2 distribution switches. After shutdown that port and removed it from etherchannel group, these messages gone away.

Only 2 days later, these messages reoccur and flooded my syslog server. After some troubleshooting, I decided to disable mls on the distribution switches (see below url: cisco said if you see these message after disabling mls, call TAC). these message no longer show up after disabling mls. I decided to re-enable mls. What is interesting is I no longer see these messages after re-enabling mls. The other mystery is I am continue to see these messages on all other switches until I disable and re-enable mls.

What is going on here????

http://www.cisco.com/en/US/customer/products/hw/switches/ps679/products_tech_note09186a0080143d13.shtml#subtopic1i

2006 Jul 23 12:17:11 pdt -07:00 %MLS-4-RESUMESC:Resume MLS after detecting too many moves

2006 Jul 23 12:17:11 pdt -07:00 %MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(40000000)

2006 Jul 23 12:17:16 pdt -07:00 %MLS-4-RESUMESC:Resume MLS after detecting too many moves

2006 Jul 23 12:17:16 pdt -07:00 %MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(40000000)

2006 Jul 23 12:17:21 pdt -07:00 %MLS-4-RESUMESC:Resume MLS after detecting too many moves

2006 Jul 23 12:17:21 pdt -07:00 %MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(40000000)

2006 Jul 23 12:17:26 pdt -07:00 %MLS-4-RESUMESC:Resume MLS after detecting too many moves

2006 Jul 23 12:17:26 pdt -07:00 %MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(40000000)

2006 Jul 23 12:17:31 pdt -07:00 %MLS-4-RESUMESC:Resume MLS after detecting too many moves

2006 Jul 23 12:17:31 pdt -07:00 %MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(40000000)

2006 Jul 23 12:17:36 pdt -07:00 %MLS-4-RESUMESC:Resume MLS after detecting too many moves

2006 Jul 23 12:17:36 pdt -07:00 %MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(40000000)

2006 Jul 23 12:17:41 pdt -07:00 %MLS-4-RESUMESC:Resume MLS after detecting too many moves

2006 Jul 23 12:17:41 pdt -07:00 %MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(40000000)

4 REPLIES
Bronze

Re: MLS question - expert advice needed

Root cause is commonly due to the presence of two devices with the same MAC address actually connected to a VLAN.Use the show mls notification and show looktable commands on the switch to point you in the right direction of the duplicate MAC address or a possible physical loop.

Re: MLS question - expert advice needed

Hello,

in order to just get rid of the messages (to clean up your syslogging), you can use the command:

set logging level mls 3 default

This will cause the switches to not log these messages anymore.

Not sure if you have seen the Cisco explanation of this message yet, anyway here is the link:

%MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec

http://www.cisco.com/warp/public/473/180.html#subtopic1i

Regards,

GNT

Re: MLS question - expert advice needed

The message means that the same mac-address was learned on two different ports. the questions is which ports, and why? Maybe a loop? finding the mac-address that flapped between two ports is the key, here is the procedure on how to track it down:

Step 1 Type "show mls notification", this will give you something like:

0: (0005f9df-00020180) Noti Chg TA 1f9df OI 180 V 1

1: (0005f9df-00020180) Noti Chg TA 1f9df OI 180 V 1

2: (0005f9df-000202c0) Noti Chg TA 1f9df OI 2c0 V 1

3: (0005f9df-00020180) Noti Chg TA 1f9df OI 180 V 1

note these fields^^^^^^^ ^^^ ^

What does return ?

This mac address is seen looping and may be traced to the root of the problem.

Step 2 Type "show looktable " to see the cam entry

For example,

"show looktable 1f9df" gives you:

Table address: 0x1f9df, Hash: 0x3f3b, Page: 7

Data: 0xc361d5f0 0x00100000 0x7e008000 0x00c00000

Parity1 SwGrp1 Entry Mac Address Vlan

0 0 00-00-0c-36-1d-5f 1

Fab AgeByte C-Mask S H L - T S V

0 fc 0 0 0 0 0 0 1

Parity2 SwGrp2 Port Index Router Xtag QOS

0 0 180 0 0

The mac address causing the move is 00-00-0c-36-1d-5f

Now you can do a show cam 00-00-0c-36-1d-5f and see from which port you had the "too many

move message"

Hope it will help.

Please rate helpful posts.

New Member

Re: MLS question - expert advice needed

Thanks everyone for your inputs.

Especially to Roberto's detail clarification.

114
Views
5
Helpful
4
Replies