Multicast Source

[vallan]

I keep getting this message all the time and frequently on a Cisco4006 Switch, increasingly so. I have traced and traced but cannot seem to find any device with MAC Address like the below. The MAC addresses are different but they all start with 45. Has anyone seen something like this and what was the solution?

Thanks

2003 Apr 15 12:10:11 BST +01:00 %SYS-4-P2_WARN: 1/Invalid traffic from multicast
source address 45:00:01:d9:a9:a0 on port 1/2

 

[IPKONFIG]

Is your 4006 connected to another non-cisco switch?

 

[IPKONFIG]

Found this on the internet. It's a MAC finder. Try putting in the 45:00 and do a search.

http://coffer.com/mac_find/

Here's what it displays:

MAC Address
prefix Vendor
006070 Cisco routers (2524 and 4500)

 

[brichr]

I have seen this message before. Im still working on a solution. It happend to me when I plugged a 2900 into my 4006 Cisco switch. I can't tell if its the switches talking to each other or a node on the 2900 announcing itself to my network. I've only seen this message once so I hope its not to big of a deal.

 

[IPKONFIG]

Found this:

%SYS-4-P2_WARN: 1/Invalid traffic from multicast source address
Problem: The switch is generating Invalid traffic from multicast source address messages.

Description: The following is an example of the syslog output you will see when this error occurs:

SYS-4-P2_WARN: 1/Invalid traffic from multicast
source address 81:00:01:00:00:00 on port 2/1
%SYS-4-P2_WARN: 1/Invalid traffic from multicast
source address 81:00:01:01:00:00 on port 2/1
The Invalid traffic from multicast source address syslog message is generated when the switch receives packets with a multicast MAC address as the source MAC. Using a broadcast or multicast MAC address as the source MAC for a frame is not standards-compliant behavior. However, the switch still forwards traffic sourced from a multicast MAC address.

The syslog message indicates the multicast MAC address in the source MAC field of the frame, and the port on which the traffic was received.

The workaround is to try to identify the end station that is generating frames with a multicast source MAC address. Typically, such frames are transmitted from a traffic generator (for example, SmartBits) or third party devices that share a multicast MAC address (for example, load balancing firewall or server products).



"I can picture a world without war. A world without hate. A world without fear. And I can picture us attacking that world, because they'd never expect it."
- Jack Handey, Deep Thoughts

 

[vallan]

No my switches are only connected to cisco switches. I am still getting the messages.
Thanks

 

[vallan]

Thanks IPKONFIG. I have also seen that on the website, and have used the MAc finder but nothing sems to belong to 45:00:00:68:2b:4a and a whole lot of them.

The 4000 are the ones that are especially hit.

Thanks