[c-nsp] MACFLAP Message

[Paul Cosgrove]

The switches learn the source mac address of incoming frames, and record the
interface and vlan on which they are received.  A switch will associate only
one interface per vlan with a particular mac address, and will use that
information to deliver any frames destined for that mac (e.g. return
traffic).  If the switch later receives a frame with the same source mac
address on a different interface in the vlan, then the switch believes that
the topology connecting the host has changed and overwrites its entry with
the new interface information.  If repeated changes are occurring quickly,
then the switch kindly informs you that the address is flapping so you can
correct the problem.

To avoid mac entry flapping on the switch you should have only one interface
(physical or logical) receive frames with a given source mac address.

For failover you may have another device use the same mac if your first
server fails, but you should not have two devices sending using the same mac
at the same time in the same vlan.  Similarly a server which uses a single
mac address for multiple interfaces in the same vlan (i.e. etherchannel)
should not use those interfaces to connect to switch ports which are not in
the same port channel.

You can connect a server etherchannel to different switches only if the
switches are in a stack and the switch ports in the same port channel within
that stack.

Paul


On Sun, Jun 27, 2010 at 3:54 PM, Bill Blackford <BBlackford at nwresd.k12.or.us
> wrote:

> Had an issue the other day that may or may not be related to the following
> message.
>
> Jun 24 11:30:37.354: %SW_MATM-4-MACFLAP_NOTIF: Host 0015.1761.8140 in vlan
> 311 is flapping between port Po4 and port Po5
> Jun 24 11:30:51.665: %SW_MATM-4-MACFLAP_NOTIF: Host 0015.176f.a6e4 in vlan
> 311 is flapping between port Po4 and port Po5
> Jun 24 11:30:52.672: %SW_MATM-4-MACFLAP_NOTIF: Host 0015.1761.8140 in vlan
> 311 is flapping between port Po5 and port Po4
> Jun 24 11:32:18.924: %SW_MATM-4-MACFLAP_NOTIF: Host 0015.176f.a742 in vlan
> 311 is flapping between port Po5 and port Po4
> Jun 24 11:32:24.460: %SW_MATM-4-MACFLAP_NOTIF: Host 0015.176f.adae in vlan
> 311 is flapping between port Po5 and port Po4
> Jun 24 11:34:12.237: %SW_MATM-4-MACFLAP_NOTIF: Host 0015.176f.a6e4 in vlan
> 311 is flapping between port Po4 and port Po5
> Jun 24 11:34:12.900: %SW_MATM-4-MACFLAP_NOTIF: Host 0015.176f.adae in vlan
> 311 is flapping between port Po5 and port Po4
> Jun 24 11:34:13.278: %SW_MATM-4-MACFLAP_NOTIF: Host 0015.176f.a742 in vlan
> 311 is flapping between port Po5 and port Po4
>
>
> VLAN311 is an Oracle heartbeat L2 vlan that spans across the data center.
> This message was logged on the 3750 VC stack (core). Each node is connected
> to access switches that each connect into the core via LACP bundles. Each of
> these MAC's are part of a Linux BOND group on various hosts. IOW, each bond
> interface member connects to each of the (in this case) two access switches.
> The topology is loop free from the perspective of the network switches as
> the LACP bundles eliminate the need for spanning tree. Now, this may be more
> of a question for how Linux bonding works across multiple access switches
> but I need to start here. I'm not finding a lot of information about this
> message. Does anyone on the group have any insight?
>
> Thank you in advance,
>
> -b
>
>
> --
> Bill Blackford
> Senior Network Engineer
> Technology Systems Group
> Northwest Regional ESD
>
> Logged into reality and abusing my sudo priviledges
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>