Submit a ticketCall us

Looking to compare latest NPM features with previous versions of NPM?
The NPM new feature summary offers a comparison of new features and improvements offered with this release.

 

 

 

 

Home > Success Center > Network Performance Monitor (NPM) > Mac Address Flap: causes and details

Mac Address Flap: causes and details

Table of contents

Updated August 25, 2016

Overview

This article provides a background on the causes of Mac address Flap

 

Logs on Cisco Switch

*Oct 20 11:48:26.254: %SW_MATM-4-MACFLAP_NOTIF: Host 0000.0000.0011 in vlan 1001 is flapping between port Gi0/23 and port Gi0/15
*Oct 20 11:48:41.286: %SW_MATM-4-MACFLAP_NOTIF: Host 0000.0000.0011 in vlan 1001 is flapping between port Gi0/23 and port Gi0/15
*Oct 20 11:48:56.286: %SW_MATM-4-MACFLAP_NOTIF: Host 0000.0000.0011 in vlan 1001 is flapping between port Gi0/15 and port Gi0/23
*Oct 20 11:49:11.286: %SW_MATM-4-MACFLAP_NOTIF: Host 0000.0000.0011 in vlan 1001 is flapping between port Gi0/15 and port Gi0/23
*Oct 20 11:49:26.318: %SW_MATM-4-MACFLAP_NOTIF: Host 0000.0000.0011 in vlan 1001 is flapping between port Gi0/23 and port Gi0/15

Environment

  • All NPM versions
  • All UDT versions
  • Enterprise Switches

Detail

A MAC Flap is caused when a switch receives packets from two different interfaces with the same source MAC address.

If you are getting the behavior for a lot of other MACs, that most likely is a layer 2 loop.

 

You can do the following:

  • Check the network switches for misconfigurations that might cause a data-forwarding loop.
  • If you are not running spanning-tree, turn it on.
  • To track down a loop, start with the following command: #show mac-address-table address [flapping mac
  • We see that the MAC is coming in on port gi0/5 and gi0/16. One port will lead us to where that MAC is plugged in and the other will lead us to the loop. Pick a port and start working through.
  • Or Some load balancing techniques can send traffic to both ports, and that would cause the switch to go crazy, since it is receiving traffic from the same MAC on two or more different ports.
  • Fix this type of LB make it active/standby or make sure the server uses 2 different mac addresses, one per NIC.
 

 

Last modified
18:10, 24 Aug 2016

Tags

Classifications

Public