differenct kind of MAC Flapping Event Log Messages

whistleblower
Building a reputation

differenct kind of MAC Flapping Event Log Messages

hi all,

 

I‘ve gone through the documentation https://documentation.meraki.com/MS/Monitoring_and_Reporting/Loop_and_MAC_Flap_Detection_on_MS already, but some questions are still open for me... 😕

can somebody please explain to me, why after the MAC-Address the marked parts are shown in that form and what does this information mean? I´d have expected that these will show on what interfaces the MAC`s have been learned, but I don`t know if thats correct - if so why is e.g. 23 shown twice in that example?

whistleblower_0-1619176642557.png

I‘d also would like to understand what that messages indicate, because that is from a productive enviroment and not explaned under that offical documentation link:

whistleblower_1-1619177415787.png

The format of the output looks different and varies, why is this the case? Unfortunatly it`s currently very difficult for me to invastigate the problem... 😞

 

thanks for any kind of information and help

1 Reply 1
Bruce
Kind of a big deal

The 23 is shown twice as it’s showing the MAC address went from port 23, to port 22, then back to port 23 - so the MAC address is flapping between those two ports.

 

In the second picture it’s hard to tell, but I believe what you are seeing is a MAC flap between port 16 and Layer 3 interfaces with a /16 subnet mask, and also between port 16 and the CPU (my guess is that would be the management interface). What model switches are these?

 

If you’re seeing a high number of MAC flaps the is usually because you have multiple paths through the network so the MAC addresses are constantly being learnt on different interfaces of a switch. This could be legitimate network activity (e.g. a wireless client moving between access points - although this doesn’t normally happen fast enough to be considered a flap), or often it’s the sign of a design/configuration error in the network.

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels