Switches, Hubs, and Modems
cancel
Showing results for 
Search instead for 
Did you mean: 

MAC moves/min

SOLVED
Go to solution
Paulen
Regular Advisor

MAC moves/min

We have several switches that report quite high MAC moves/min numbers. Is it possible to trap the MAC address that moved? We are trying to troubleshoot poor performance in general, and this parameter would be something to dig into.

Can the switch display the MAC address that moved via cli, or - preferably - trap it via snmp?
9 REPLIES
Mohieddin Kharnoub
Honored Contributor

Re: MAC moves/min

Hi

From the CLI, the show mac, can show you a list of the MAC in the switch's table.
So i believe if you have something tracks and save that list in a database it is possible, but i not sure how.

basically, once the MAC moved, the MAC list will be updated in the switch, and that also can be controlled by the MAC age time out.

Note:
-----
With the IDM, you can actually do better than that, where you combine a flavor of security with the Time and Location then print out a full report for a day (or any period) shows you that USER's moves along your network based on the Switches and Ports also.

Good Luck !!!

Science for Everyone
Matt Hobbs
Honored Contributor
Solution

Re: MAC moves/min

In the 'show tech all' do a search for 'addrmgrmovelist'
Paulen
Regular Advisor

Re: MAC moves/min

Hi,

Is this confined to a certain switch type? On a 5304xl there are no 'addrmgrmovelist' in show tech all.
Paulen
Regular Advisor

Re: MAC moves/min

OK; found this in (at least) 10.61 on 5304xl:

addrmgrmovelist
mac address vid old port new port timestamp
------------- ---- -------- -------- -----------------
0019bb-8dbb26 1 A24 A24 08/03/07 08:34:55
000d56-c1d447 20 A13 A13 08/03/07 08:34:55
0019e2-8434db 1 C2 C2 08/03/07 08:34:56
001646-1ac944 1403 B1 B1 08/03/07 08:35:10
000d56-fed754 20 B1 B1 08/03/07 08:35:10
000d54-a135a8 2001 B1 B1 08/03/07 08:35:13


However - I wouldn't say that these MACs have been moving that much..?
Paulen
Regular Advisor

Re: MAC moves/min

Just another update..

On a 'live' switch I have this strange behaviour:

addrmgrmovelist
mac address vid old port new port timestamp
------------- ---- -------- -------- -----------------
000dda-04a480 5 13 2 08/03/07 09:02:15
000dda-04a480 5 2 13 08/03/07 09:02:15
000dda-04a480 5 13 2 08/03/07 09:02:15
000dda-04b06e 5 2 1 08/03/07 09:02:15
000dda-04a480 5 2 13 08/03/07 09:02:16
000dda-04a480 5 13 2 08/03/07 09:02:16
000dda-04b06e 5 1 2 08/03/07 09:02:17
000dda-04a480 5 2 13 08/03/07 09:02:34
000dda-04a480 5 13 2 08/03/07 09:02:35
000dda-04a480 5 2 13 08/03/07 09:02:35
000dda-04a480 5 13 2 08/03/07 09:02:35
000dda-04a480 5 2 13 08/03/07 09:02:36
000dda-04a480 5 13 2 08/03/07 09:02:36
000dda-04a480 5 2 13 08/03/07 09:02:44
000dda-04a480 5 13 2 08/03/07 09:02:44
000dda-04b06e 5 2 1 08/03/07 09:02:46
000dda-04b06e 5 1 2 08/03/07 09:02:47
000dda-04a480 5 2 13 08/03/07 09:02:47
000dda-04a480 5 13 2 08/03/07 09:02:47
000dda-04a480 5 2 13 08/03/07 09:02:57
000dda-04a480 5 13 2 08/03/07 09:02:57
000dda-04a480 5 2 13 08/03/07 09:03:08
000dda-04a480 5 13 2 08/03/07 09:03:11
000dda-04a480 5 2 13 08/03/07 09:03:15
000dda-04a480 5 13 2 08/03/07 09:03:15

Seems that two MACs are "flapping" - possibly due to an error on a DSLAM. Will investigate further, this might be interresting for more than just me :o)
Matt Hobbs
Honored Contributor

Re: MAC moves/min

A lot of the time they're just flipping around because of some instability in the spanning-tree topology. Check your 'show span' to see if the time from the last topology change correlates to the time of the mac moves.
Paulen
Regular Advisor

Re: MAC moves/min

I disabled the VLAN in question on the customer's port, and everything went silent. I do not have spanning-tree enabled. This must be due to a flaw in either DSLAM or CPE.

Anyone knows how to turn on or
 in this forum.. This would look much nicer then:

MAC moves/min 0 0 0 45 33
Low * * 0 0 0
High * * 0 1556 1556

In short it says that yesterday was bad, today is good.
Paulen
Regular Advisor

Re: MAC moves/min

OK; that little tick mark made this is a little bit better :o)

Current Prev Prev Prev Since
Value 5 Min Hour Day Boot
MAC moves/min 0 0 0 45 33
Low * * 0 0 0
High * * 0 1556 1556
Paulen
Regular Advisor

Re: MAC moves/min

FYI:

'addrmgrmovelist' was added in the following releases:

2500: n/a
2510: Q.10.03
2600: H.10.23
2824: I.10.23
2810: N.10.06
3400cl: M.10.23
5304xl: E.10.48
5406zl: K.11.64