differenct kind of MAC Flapping Event Log Messages

[whistleblower]

hi all,

I‘ve gone through the documentation https://documentation.meraki.com/MS/Monitoring_and_Reporting/Loop_and_MAC_Flap_Detection_on_MS already, but some questions are still open for me... 😕

can somebody please explain to me, why after the MAC-Address the marked parts are shown in that form and what does this information mean? I´d have expected that these will show on what interfaces the MAC`s have been learned, but I don`t know if thats correct - if so why is e.g. 23 shown twice in that example?

I‘d also would like to understand what that messages indicate, because that is from a productive enviroment and not explaned under that offical documentation link:

The format of the output looks different and varies, why is this the case? Unfortunatly it`s currently very difficult for me to invastigate the problem... 😞

thanks for any kind of information and help

[Bruce]

The 23 is shown twice as it’s showing the MAC address went from port 23, to port 22, then back to port 23 - so the MAC address is flapping between those two ports.

In the second picture it’s hard to tell, but I believe what you are seeing is a MAC flap between port 16 and Layer 3 interfaces with a /16 subnet mask, and also between port 16 and the CPU (my guess is that would be the management interface). What model switches are these?

If you’re seeing a high number of MAC flaps the is usually because you have multiple paths through the network so the MAC addresses are constantly being learnt on different interfaces of a switch. This could be legitimate network activity (e.g. a wireless client moving between access points - although this doesn’t normally happen fast enough to be considered a flap), or often it’s the sign of a design/configuration error in the network.