MAC moves/min

[Paulen]

We have several switches that report quite high MAC moves/min numbers. Is it possible to trap the MAC address that moved? We are trying to troubleshoot poor performance in general, and this parameter would be something to dig into.

Can the switch display the MAC address that moved via cli, or - preferably - trap it via snmp?

[Mohieddin Kharnoub]

Hi

From the CLI, the show mac, can show you a list of the MAC in the switch's table.
So i believe if you have something tracks and save that list in a database it is possible, but i not sure how.

basically, once the MAC moved, the MAC list will be updated in the switch, and that also can be controlled by the MAC age time out.

Note:
-----
With the IDM, you can actually do better than that, where you combine a flavor of security with the Time and Location then print out a full report for a day (or any period) shows you that USER's moves along your network based on the Switches and Ports also.

Good Luck !!!

[Matt Hobbs · Accepted solution]

In the 'show tech all' do a search for 'addrmgrmovelist'

[Paulen]

Hi,

Is this confined to a certain switch type? On a 5304xl there are no 'addrmgrmovelist' in show tech all.

[Paulen]

OK; found this in (at least) 10.61 on 5304xl:

addrmgrmovelist
mac address vid old port new port timestamp
------------- ---- -------- -------- -----------------
0019bb-8dbb26 1 A24 A24 08/03/07 08:34:55
000d56-c1d447 20 A13 A13 08/03/07 08:34:55
0019e2-8434db 1 C2 C2 08/03/07 08:34:56
001646-1ac944 1403 B1 B1 08/03/07 08:35:10
000d56-fed754 20 B1 B1 08/03/07 08:35:10
000d54-a135a8 2001 B1 B1 08/03/07 08:35:13


However - I wouldn't say that these MACs have been moving that much..?

[Paulen]

Just another update..

On a 'live' switch I have this strange behaviour:

addrmgrmovelist
mac address vid old port new port timestamp
------------- ---- -------- -------- -----------------
000dda-04a480 5 13 2 08/03/07 09:02:15
000dda-04a480 5 2 13 08/03/07 09:02:15
000dda-04a480 5 13 2 08/03/07 09:02:15
000dda-04b06e 5 2 1 08/03/07 09:02:15
000dda-04a480 5 2 13 08/03/07 09:02:16
000dda-04a480 5 13 2 08/03/07 09:02:16
000dda-04b06e 5 1 2 08/03/07 09:02:17
000dda-04a480 5 2 13 08/03/07 09:02:34
000dda-04a480 5 13 2 08/03/07 09:02:35
000dda-04a480 5 2 13 08/03/07 09:02:35
000dda-04a480 5 13 2 08/03/07 09:02:35
000dda-04a480 5 2 13 08/03/07 09:02:36
000dda-04a480 5 13 2 08/03/07 09:02:36
000dda-04a480 5 2 13 08/03/07 09:02:44
000dda-04a480 5 13 2 08/03/07 09:02:44
000dda-04b06e 5 2 1 08/03/07 09:02:46
000dda-04b06e 5 1 2 08/03/07 09:02:47
000dda-04a480 5 2 13 08/03/07 09:02:47
000dda-04a480 5 13 2 08/03/07 09:02:47
000dda-04a480 5 2 13 08/03/07 09:02:57
000dda-04a480 5 13 2 08/03/07 09:02:57
000dda-04a480 5 2 13 08/03/07 09:03:08
000dda-04a480 5 13 2 08/03/07 09:03:11
000dda-04a480 5 2 13 08/03/07 09:03:15
000dda-04a480 5 13 2 08/03/07 09:03:15

Seems that two MACs are "flapping" - possibly due to an error on a DSLAM. Will investigate further, this might be interresting for more than just me :o)

[Matt Hobbs]

A lot of the time they're just flipping around because of some instability in the spanning-tree topology. Check your 'show span' to see if the time from the last topology change correlates to the time of the mac moves.

[Paulen]

I disabled the VLAN in question on the customer's port, and everything went silent. I do not have spanning-tree enabled. This must be due to a flaw in either DSLAM or CPE.

Anyone knows how to turn on or

 in this forum.. This would look much nicer then:

MAC moves/min                  0          0          0         45         33
                  Low          *          *          0          0          0
                 High          *          *          0       1556       1556

In short it says that yesterday was bad, today is good.

[Paulen]

OK; that little tick mark made this is a little bit better :o)

Current Prev Prev Prev Since
Value 5 Min Hour Day Boot
MAC moves/min 0 0 0 45 33
Low * * 0 0 0
High * * 0 1556 1556

[Paulen]

FYI:

'addrmgrmovelist' was added in the following releases:

2500: n/a
2510: Q.10.03
2600: H.10.23
2824: I.10.23
2810: N.10.06
3400cl: M.10.23
5304xl: E.10.48
5406zl: K.11.64