Mac address table corruption?

We are running Cisco 4500 chassis at the access layer, and have been for a few years without issue. Recently we started to experience issues where a mac address will just randomly "jump" to another port. User will call us and say their computer is not working. We will locate the mac, and its showing on the wrong port. We shut that port, do a no shut, and the mac jumps back to the correct port. In the example below, the mac address jumps to port 3/2, but is physically connected to 2/12.
!--issue before shut/no shut
mdf#show mac address-table | inc 9ebf
236      782b.cb8c.9ebf    static ip,ipx,assigned,other GigabitEthernet3/2
!--port security knows the correct info however
mdf#show ip dhcp snooping binding | inc 9E:BF
78:2B:CB:8C:9E:BF   xxx.xxx.236.193   76145       dhcp-snooping   236   GigabitEthernet2/12
mdf#show mac address-table int gi2/12
Unicast Entries
vlan     mac address     type        protocols               port
---------+---------------+--------+---------------------+-------------------------
3908      20bb.c021.ae58    static ip,ipx,assigned,other GigabitEthernet2/12   !--ip phone
mdf#show mac address-table int gi3/2
Unicast Entries
vlan     mac address     type        protocols               port
---------+---------------+--------+---------------------+-------------------------
236      1803.7339.d93d    static ip,ipx,assigned,other GigabitEthernet3/2
236      782b.cb8c.9ebf    static ip,ipx,assigned,other GigabitEthernet3/2         !--mac in question
236      782b.cb8c.c366    static ip,ipx,assigned,other GigabitEthernet3/2
3908      b414.89a2.2ae0    static ip,ipx,assigned,other GigabitEthernet3/2
!--fixing issue
mdf(config)#int gi3/2
mdf(config-if)#shut
!-- issue resolved
mdf#show mac address-table | inc 9ebf
236      782b.cb8c.9ebf    static ip,ipx,assigned,other GigabitEthernet2/12
Switch is running cat4500e-entservicesk9-mz.151-2.SG2.bin , but also happened on cat4500e-entservicesk9-mz.151-2.SG4.bin and cat4500e-entservicesk9-mz.150-2.SG4.bin. Other switches have also had this issue occur.

Looks to be me like a bug.
could you please provide me some more details on this:
1- How often this issue is occurring?
2- Is this occurring to specific ports or specific laptops which are connecting to this ports or is it irrespective of devices?
3- Is there any possibilities that you try rebooting one of the switch if the issue is very often? (I know this is not a feasible solution , I know it is some issue iwth the firmware but in case to avoid high impact you can reboot the switch and update me?
4- Provide me with the logs from the switch?
5- I will do the bug scrub and let you know.
HTH

Similar Messages

Mac address table on a PIX

What am i missing?
pixfirewall# show mac-address-table
                   ^
ERROR: % Invalid input detected at '^' marker.
[EDIT: karat is under the A in mac ]
pixfirewall# sh ver
Cisco PIX Security Appliance Software Version 8.0(4)
Device Manager Version 6.1(3)
Compiled on Thu 07-Aug-08 19:42 by builders
System image file is "flash:/image.bin"
Config file at boot was "startup-config"
pixfirewall up 175 days 11 hours
Hardware:   PIX-525, 256 MB RAM, CPU Pentium III 600 MHz
Flash E28F128J3 @ 0xfff00000, 16MB
BIOS Flash AM29F400B @ 0xfffd8000, 32KB
0: Ext: Ethernet0           : address is 000d.28f9.62a5, irq 10
1: Ext: Ethernet1           : address is 000d.28f9.62a6, irq 11
2: Ext: Ethernet2           : address is 000d.8810.a620, irq 11
3: Ext: Ethernet3           : address is 000d.8810.a621, irq 10
4: Ext: Ethernet4           : address is 000d.8810.a622, irq 9
5: Ext: Ethernet5           : address is 000d.8810.a623, irq 5
Licensed features for this platform:
Maximum Physical Interfaces : 6
Maximum VLANs                : 25
Inside Hosts                 : Unlimited
Failover                     : Disabled
VPN-DES                      : Enabled
VPN-3DES-AES                 : Enabled
Cut-through Proxy            : Enabled
Guards                       : Enabled
URL Filtering                : Enabled
Security Contexts            : 0
GTP/GPRS                     : Disabled
VPN Peers                    : Unlimited
This platform has a Restricted (R) license.
Serial Number: 807234146
Running Activation Key: 0x6ab205ba 0x986d4239 0xf56523af 0x76f3d58b
Configuration last modified by enable_15 at 12:58:08.130 EDT Thu May 16 2013
pixfirewall# show mac-address-table
                   ^
ERROR: % Invalid input detected at '^' marker.

Hi,
Command Modes The following table shows the modes in which you can enter the command:
Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System
Privileged EXEC
Source:
http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/s4.html#wp1448364
- Jouni

CNA 5.5 and show mac address-table

When trying to Monitor/Search for MAC address in C2960 network I got an error reply that a CLI command is not supported. Analyzing network traffic shows that CNA 5.5 is issueing 'show mac-address-table' command but the latest Cisco IOS Software, C2960 Software (C2960-LANBASEK9-M), Version 12.2(55)SE does not support 'show mac-address-table' anymore but does support 'show mac address-table' command. How can I change the command for showing mac address tables in CNA 5.5?
M.

hi john,
the show mac-address-table command should be valid.
check if you've got MAC learning enabled on the ASA interface using show mac-learn command.
edit: could you post show firewall? the above command works on transparent firewall only.

Show mac-address-table not working on ASA5512

Hi,
I'm unable to excute "show mac-address-table" on an ASA5512, running 9.1(1). The output is:
asa-test# show mac-address-table
^
ERROR: % Invalid input detected at '^' marker.
Has the command changed for this model / version? It works fine on ASA5505's running 8.4(5).
Thanks for your time,
John

hi john,
the show mac-address-table command should be valid.
check if you've got MAC learning enabled on the ASA interface using show mac-learn command.
edit: could you post show firewall? the above command works on transparent firewall only.

Mac-address-table takes too long to update on 4507R

Hi,
I'm trying to use spectralink phones, I have autonomous APs on seperate 2960s (and one on the 4507) - when the phones roam between the APs it takes very long for the mac address table to update on the 4507 even though there's uplink traffic.
I have supervisor engine II+ (I read there are problems in previous versions)
can anyone help?
thanks

Upgrading the switch could help avoid this problem..

Maximum MAC address table size

Hello guys.
what is the maximum MAC address table for the Cisco 3750X series switches?

Scalability Numbers
MAC, routing, security, and QoS scalability numbers depend on the type template used in the switch. Routing template is not supported in the LAN Base feature set. Table 10 shows Cisco Catalyst 3750-X and 3560-X Series Switch scalability numbers.
Cisco Catalyst 3750-X and 3560-X Series Switch Scalability Numbers
Access
Default
Routing
VLAN
Unicast MAC addresses
4K
6K
3K
12K
IGMP groups and multicast routes
1K
1K
1K
1K
Unicast routes
6K
8K
11K
0
Directly connected hosts
4K
6K
3K
0
Indirect routes
2K
2K
8K
0
Policy-based routing ACEs
0.5K
0
0.5K
0
QoS classification ACEs
0.5K
0.5K
0.5K
0.5K
Security ACEs
2K
1K
1K
1K
VLANs
1K
1K
1K
1K

Show mac-address-table

Given the command show mac-address-table from the privilege exec mode in a cat 2950, the output shows some (i think 4) mac-address tha are system. Do u have any idea what are these mac?

Hi Dimitris,
Thanks for writing in. I tried the command on my switch and got the following: Do you see a similar output and is this what you are referring to?
2950#sh mac-address-table
Mac Address Table
Vlan Mac Address Type Ports
All 0009.7c70.f9c0 STATIC CPU
All 0100.0ccc.cccc STATIC CPU
All 0100.0ccc.cccd STATIC CPU
All 0100.0cdd.dddd STATIC CPU
0100.0ccc.cccc is used for CDP/VTP/DTP/PAgP/UDLD
0100.0ccc.cccd is used for PVST+
0100.0cdd.dddd seems to be related to multicast, however need to confirm on this.
0009.7c70.f9c0 is the mac address for my management vlan interface.
2950#sh int vlan 1
Vlan1 is administratively down, line protocol is down Hardware is CPU Interface, address is 0009.7c70.f9c0 (bia 0009.7c70.f9c0)
Hope this helps.
regards
-Alok

Mac Address Table

Hello,
In one of our core switches, the output of the mac-address-table shows some mac addresses which come up as MPLS Multicast address when I looked them up under MAC Manufacturer(See below). Also, in the mac-address-table under the port column, those mac addresses display several ports associated with them and the word Router(see attachement). My question is, why are these MAC addresses come up as MPLS Multicast and why under the ports is it has the word Router?
Thanks in advance...
Prefix
Vendor
01005E
Internet Multicast (01:00:5E:00:00:00 to 01:00:5E:7F:FF:FF)
01005E
MPLS Multicast (01:00:5E:80:00:00 to 01:00:5E:8F:FF:FF)
01005E
Internet reserved by IANA (01:00:5E:90:00:00 to 01:00:5E:FF:FF:FF)
01005E
Internet reserved by IANA (01:00:5E:90:00:00 to 01:00:5E:FF:FF:FF)
01005E
MPLS Multicast (01:00:5E:80:00:00 to 01:00:5E:8F:FF:FF)
01005E
Internet Multicast (01:00:5E:00:00:00 to 01:00:5E:7F:FF:FF)

Hi,
Yes multiple MAC addresses are supported on each port. The switch learns the MAC by noting the source address of the packet received on each port and on that basis it builds what we call MAC address table. There is an aging mechanism in place which removes the inactive MAC addresses and allows new ones to be learned as devices are connected and disconnected.
The default aging time is 300 seconds, however if need arises you can change the same by giving the command - 'mac address-table aging time number vlan vlan-id'.
Have a look at the following link-->
http://www.cisco.com/en/US/products/hw/switches/ps5213/products_configuration_guide_chapter09186a00801cdf85.html#wp1063713
Hope this helps!
Regards,
AbhisheK
Please rate all helpful posts!!!

Mac-address-table synchronize

Dears
Would like your assistance please regarding command "mac-address-table synchronize"
My understanding is that it syncs CAM table between different DFCs & RSP PFC
So If we are having only one DFC there would be no need for this command. It will only be useful in case we are having several DFCs or there is a communication between DFC and ports connected in RSP.
1- Correct ?
2- Is SVI interface considered to be part of DFC or PFC ?
I am asking this cause if part of PFC then this command would be needed
Many Thanks
Regards
Sherif Ismail

Sherifismail,
I see that its already been answered anyway again:
My understanding is that it syncs CAM table between different DFCs & RSP PFC
==Answer is yes.
So If we are having only one DFC there would be no need for this command. It will only be useful in case we are having several DFCs or there is a communication between DFC and ports connected in RSP.
1- Correct ?
Answer: No you still required. else sometime you might see the mac address present in the software and not on the module.
2- Is SVI interface considered to be part of DFC or PFC ?
I am asking this cause if part of PFC then this command would be needed
Answer: I would believe it would be part of PFC.
HTH

Mac address table to vm name mapping

Is there a command that will show the mac address table to vm name mapping from the fabric interconnect or the nexus 1k?

Register to Ciscolive365 and download BRKCOM-3003 , which has answers to all your questions.

MAC Address-Table Move Update Feature

Hi guys
Does 6500 SUP720/2T support MAC Address-Table Move Update Feature?
I cannot find it in anywhere..
Thanks very much!
QXZ

Hi,
Please refer following link :
http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a00807347ab.shtml
CAM
—All Catalyst switch models use a CAM table for Layer 2 switching. As frames arrive on switch ports, the source MAC addresses are learned and recorded in the CAM table. The port of arrival and the VLAN are both recorded in the table, along with a timestamp. If a MAC address learned on one switch port has moved to a different port, the MAC address and timestamp are recorded for the most recent arrival port. Then, the previous entry is deleted. If a MAC address is found already present in the table for the correct arrival port, only its timestamp is updated.
regards,
Ajay Kumar

MAC address table vs. CAM table

MAC address table vs. CAM table. How they are different?

I don't believe there is a difference as such. CAM simply refers to the way the switch uses memory (in a content-addresable) manner to look up the MAC address to port association.
Paresh

How can I see the mac address table of a vSwitch

I am having some ARP collisions on my network and have determined that the offending mac address belongs to VMWare. I have already looked at the mac address tables of my physical switches but can't find the VMWare mac address I'm looking for. I would like to look at the mac address tables of the standard vSwitches to try to track down the root of the problem, but I fear that is not a possibility.
Does anyone know a method to display the mac address table on a vSwitch?

Hi midi25,
>>I would like to be able to see what devices are connected and if possible remove any stale entries.
Hyper-v virtual switch doesn't need us to manually maintain that "table" like a physical switch .
Best Regards,
Elton Ji
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected] .

Can't clear mac address table from interface

hello all.
I'm facing a problem, and i've also tried to workaround but not sucessfully.
I've got a polycom phone on the swich. When I connect a laptop on that port, the mac address is learned by the switch and keep the mac address even if I disconnect the ethernet cable from that port and if I try to connect the same laptop on other port on the same switch I've got errdisable error in the last connected port. Although I was figuring out what's wrong and seems that the mac address is kept for some reason in the first port.
sw02#show mac address-table interface f0/19
Mac Address Table
Vlan Mac Address Type Ports
60 3c07.5417.9069 STATIC Fa0/19
80 0004.f21e.afa7 STATIC Fa0/19
this is a 2960, Version 12.2(44r)SE4
with a Polycom SoundPoint IP 330 connected on vlan 80
I was searching to clear the mac address table on that interface but the IOS version didn't give me the static option
sw02#clear mac address-table ?
dynamic dynamic entry type
move move keyword
notification Clear MAC notification Global Counters
As there's no dynamic entries on that interface the mac addresses remain on the f0/19 interface.
I've tried with other switches and with other laptops and is the same errdisable status.
sw02#show run int f0/19
interface FastEthernet0/19
description VoIP
switchport access vlan 60
switchport mode access
switchport nonegotiate
switchport voice vlan 80
switchport port-security maximum 5
switchport port-security
no snmp trap link-status
ip dhcp snooping limit rate 100
end
any thought?

the mac addresses are not manually configured.
yes, that's my point. when I disconnect the ethernet cable the mac addresses are not flushed from the mac table.
Although I don't understand why the mac addresses are kept in the interface, if I force the interface aging time to 1 min, the problem don't occur anymore.
I was reviewing the switch config and I've got ports with aging time 0 (that learn and flush the mac addresses dynamically) and I've got ports with aging time 1 (that learn and flush the mac addresses at the end of 60 seconds)
The problem is solved although I need to investigate this issue in other switch models and with other voip phones.
Tks Jon and Julio

Why "mac-address-table static 0000.0c07.ac01 interface FastEthernet1/0 vlan 3" in the router ?

Hi All
I did not type the following command. Why does it appear when I show run ? Which command can cause the issue? Thank you
mac-address-table static 0000.0c07.ac01 interface FastEthernet1/0 vlan 3

Hello,
It looks as if you have HSRP configured. Mac address 0000.0c07.ac01 is the HSRP virtual mac address. 01 at the end of the mac represents the HSRP group number.
Hope this helps,
Please rate helpful answers.
Thanks.

Mac address table corruption?

Similar Messages

Maybe you are looking for