Invalid Multicast Address - MAC Address 1

[vallan]

I keep getting this message on the swithes:

%SYS-4-P2_WARN: 1/Invalid traffic from multicast source address 45:00:00:a2:1e:72 on port 1/2.

I have tried searching the port belonging to the MAC addreess but have not found out. I have used all the show commands but all the ports start with 00:00 but none with 45:00 and I really do need to find out how I can get the port belonging to this MAC addreess.

Please help

 

[jgercken]

45:00:00:a2:1e:72

This is not a usual 'legal' address for ethernet (canonical) because:

Multicast mac addresses are created by adding the mac: 01.00.5E.00.00.00 to the rightmost 23 bits from the multicast IP. Since your address isn't anything like this it isn't a 'normal' multicast mac.

Bit 8 is the (I/G) bit. Here it is 1 since the 2nd hex digit in your mac is odd. This means that the mac is a group mac (vs individual).

The skinny is that this is kinda odd and you should probably track down the source because it's not playing well with others.

-Jeff ----------------------------------------
Wasabi Pop Tarts! Write Kellogs today!

 

[vallan]

Thanks. That is the issue. I am trying to find out how to get this rogue multicast address but still have not been able to with all the cisco command available. Do you know of any way I can find out where this address s coming from.?

Thanks

 

[rcasta]

Why don't you try "sniffin'" port 1/2.

(using "port monitor" or "port span", can't remember =) )

cheers,

 

[jgercken]

Sniffing a span port isn't going to tell you anything you don't already know. What kind of network is attached to port 1/2? Is there a way to segment it? You have to track the source down by stiffing the 'branches' of the network until you see the mac then working up from there.
-Jeff ----------------------------------------
Wasabi Pop Tarts! Write Kellogs today!

 

[vallan]

It is a trunk port connected to a core switch.

Thanks

 

[brichr]

I have received this same message. Of course with a different source address and port number. What I was wondering is why I got the message? Right now I have two Cisco switches plugged into each other. A 4000 and a 2900. The message said the multicast is coming from the port where my 2900 is plugged into my 4000. I also realize that it might not be a switch problem but a problem with a node. Could something on my 2900 be announcing itself to the network? Or is there a port configuration option that I need to manipulate on the switches.

 

[IPKONFIG]

Found this:

%SYS-4-P2_WARN: 1/Invalid traffic from multicast source address
Problem: The switch is generating Invalid traffic from multicast source address messages.

Description: The following is an example of the syslog output you will see when this error occurs:

SYS-4-P2_WARN: 1/Invalid traffic from multicast
source address 81:00:01:00:00:00 on port 2/1
%SYS-4-P2_WARN: 1/Invalid traffic from multicast
source address 81:00:01:01:00:00 on port 2/1
The Invalid traffic from multicast source address syslog message is generated when the switch receives packets with a multicast MAC address as the source MAC. Using a broadcast or multicast MAC address as the source MAC for a frame is not standards-compliant behavior. However, the switch still forwards traffic sourced from a multicast MAC address.

The syslog message indicates the multicast MAC address in the source MAC field of the frame, and the port on which the traffic was received.

The workaround is to try to identify the end station that is generating frames with a multicast source MAC address. Typically, such frames are transmitted from a traffic generator (for example, SmartBits) or third party devices that share a multicast MAC address (for example, load balancing firewall or server products).



"I can picture a world without war. A world without hate. A world without fear. And I can picture us attacking that world, because they'd never expect it."
- Jack Handey, Deep Thoughts

 

[vipergg]

Yeah I have never had much luck in tracing these down , the thing we see is we get the same message but for some non-existent port like 4/60 , so I don't know where to even look when you get them on nonexistent ports.

 

[vallan]

Does any one has anything new on this issue. We are still receiving the message. Although it is not impacting the workings of the Switch but it still very annoying to receive this.

Anything new???

 

[filoips]

I have the same problem :
these are my mac :
switch : x4a mac :45:00:00:28:4c:23 port : 2/15
switch : x4a mac :45:00:00:28:9c:43 port : 2/15
switch : x4b mac :45:00:00:28:76:39 port : 3/11
switch : x2a mac :45:00:00:28:30:15 port : 3/18
switch : x2a mac :45:00:00:28:4d:4a port : 3/18
switch : x2a mac :45:00:00:28:67:2e port : 3/18
switch : x2a mac :45:00:00:28:69:3e port : 3/18
switch : x2a mac :45:00:00:28:7f:ad port : 3/18
switch : x2a mac :45:00:00:28:bb:e4 port : 3/18
switch : x2a mac :45:00:00:28:cf:55 port : 3/18
switch : x2a mac :45:00:00:28:e9:86 port : 3/18
switch : x2a mac :45:00:00:28:ea:f4 port : 3/18
switch : x2a mac :45:00:00:28:f7:f0 port : 3/18
switch : x2a mac :45:00:00:28:fa:01 port : 3/18

the whole network is based on cisco system,
it seems that the last 3 byte change .....

the device connected to these port are laptop, desktop with standard software.

Bye
filoips