Troubleshooting Of MAC Flapping For S7703

Publication Date:  2014-11-20 Views:  339 Downloads:  0
Issue Description
eSight detect the phenomenon MAC Flapping in S7703.
Alarm Information
This is the screenshot of alarm from eSight:
Handling Process
1. MAC address flapping occurs in the following situations: a. Network cables of switches are connected incorrectly or switches use incorrect configurations;b. Unauthorized users simulate MAC address of valid network devices to attack the network. Firstly check the indicators. The indicators never flashing frequently. Secondly collect the information by the command display interface brief. The figure of InUti and OutUti is very low. Thirdly collect the information of Spanning Tree by the command display stp. The protocol of MSTP is enable the setting for the ports is appropriate. Eliminate the root cause is by the ring in the network.
2. Check the information of display trapbuffe. The information about MAC Flapping is just as below:
#Oct 30 2014 14:28:02 S7703 L2IFPPI/4/MAC_FLAPPING_ALARM:OID 1.3.6.1.4.1.2011.5.25.42.2.1.7.12 The mac-address has flap value.  (L2IfPort=0,entPhysicalIndex=0,  BaseTrapSeverity=4, BaseTrapProbableCause=549, BaseTrapEventType=1,  MacAdd=1047-808a-e2f6,vlanid=99, FormerIfDescName=GigabitEthernet3/0/44, CurrentIfDescName=XGigabitEthernet1/0/0,DeviceName= S7703)
#Oct 30 2014 14:26:02 S7703 L2IFPPI/4/MAC_FLAPPING_ALARM:OID 1.3.6.1.4.1.2011.5.25.42.2.1.7.12 The mac-address has flap value.  (L2IfPort=0,entPhysicalIndex=0, BaseTrapSeverity=4, BaseTrapProbableCause=549, BaseTrapEventType=1,  MacAdd=1047-808a-e2f6,vlanid=99, FormerIfDescName=XGigabitEthernet1/0/0, CurrentIfDescName=GigabitEthernet3/0/44,DeviceName=SS7703)
From the information we found only the MAC Address 1047-808a-e2f6 flapping,and the switch learned the MAC Address from the interface XGE1/0/0 & GE3/0/44.
3. Confirm the MAC Address 1047-808a-e2f6 belong to which equipment by the command display arp | in 1047-808a-e2f6
<S7703>display arp | in 1047-808a-e2f6
IP ADDRESS      MAC ADDRESS     EXPIRE(M) TYPE        INTERFACE   VPN-INSTANCE
                                          VLAN/CEVLAN
------------------------------------------------------------------------------
10.0.99.44      1047-808a-e2f6  20        D-0/0       XGE1/0/0
10.0.99.45      1047-808a-e2f6  20        D-0/0       GE3/0/44
------------------------------------------------------------------------------
Total:326       Dynamic:305     Static:0     Interface:21   
4. From the ARP mapping list, we can find the MAC Address of 1047-808a-e2f6 belong to IP Address 10.0.99.44 and 10.0.99.45. So the MAC addresses of two equipments are the same. Finally we found customer changed the MAC Address of one IA5000 this is the root cause.
5. Resume the MAC Address of IA5000 to the default value. Then the phenomenon of MAC Flapping disappear.
Root Cause
Because of human factors the MAC addresses of two equipments are the same. That cause the MAC Flapping.
Suggestions
During troubleshooting, using different way to reduce the arrange of  possible root cause. That will be helpful for the work.

END