3

We've been having an issue for the last few weeks on a relatively small network. The issue started when we swapped a specific Cisco 3750 for a 2960G (there were some other changes), exactly since then we now get the following notifications all day long:

019534: Feb 27 01:28:39: %SW_MATM-4-MACFLAP_NOTIF: Host 0016.3e64.98e2 in vlan 100 is flapping between port Gi0/22 and port Gi0/24

We get this on multiple mac addresses and multiple vlans, the above is the most common one we see (there are thousands per day).

The mac address in question is for a VM on a server, obviously the server does not move and is physically located on another switch directly connected to Gi0/24. Gi0/22 is the uplink to the central router (there are other switches upstream, non if which are logging flaps), so the questions follows - how is this switch learning the VM's mac on Gi0/22 ?

Obviously the first thing was to eliminate a L2 loop, we have looked into this many times, rebuilding diagrams from scratch using both cdp and physical tracing and we absolutely cannot find a loop anywhere. Additionally, STP is not reporting any blocked paths, confirming that no loop has been detected.

Any help or tips on how to debug this would be greatly appreciated.

Improve this question
4
  • Can we see a sanitized config for both the switch and the central router? Are you running any bridge groups on the router? Is the hypervisor multi-homed into multiple switches? If so, is the hypervisor correctly pinning VMS to one NIC or the other?
    – Keller G
    Feb 27, 2015 at 2:59
  • Might also be the router attempting to Proxy ARP. I'd make sure your L2 paths are as they should be to get hosts to their gateway. Probably should disable Proxy ARP on the router if it hasn't already been so just to be safe.
    – Eddie
    Feb 27, 2015 at 7:40
  • Are you sure that both ports don't go to the VM host?
    – cpt_fink
    Mar 1, 2015 at 23:55
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 11, 2017 at 4:31

3 Answers 3

Reset to default
2

Hunt for an L2 loop or a software misbehaviour.

Start at 2960G/Gi0/22, and go to the upstream router let's say R1. Search on which port is the @MAC: 00:16:3e:64:98:e2, let's say R1/Gi0/7. Go to the network equipment connect on R1/Gi0/7, and go ahead until you reach the final port which says it sees this @MAC.

If this isn't a physical connection to the same machine,

  • check for an L2 wireless loop (through a wireless access point),
  • check for a VLAN L2 loop (same VLAN trunked on 2 different ports),
  • check for a rogue repeater, switch or AP,
  • check for a ghost value at the CAM level (clear the port).
Improve this answer
2

Possibilities...

  • undetected L2 loop (physical, or logical)
  • VM running in more than one host (HA?)
  • host connected to multiple switches
  • LACP misconfiguration

You've given very little information on the network and VM infrastructure. It's possible something is causing a logical loop -- eg. VM copying traffic. I don't know what that VM is, how it's connected, or what it's doing.

For example, I've had this problem with the Alteon virtual appliance. It's HA is done via a hacked ("customized") VRRP that always uses a VRID of 1. More than one VA HA pair in a network causes MAC flaps. (until you manually change the VRID) Also, if the same network is attached to more than one vNIC, it'll "self loop".

Improve this answer
-1

Usually it's because of a misconfigured port channel, e.g. etherchannell configured at one side only.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.