We have several switches that report quite high MAC moves/min numbers. Is it possible to trap the MAC address that moved? We are trying to troubleshoot poor performance in general, and this parameter would be something to dig into.
Can the switch display the MAC address that moved via cli, or - preferably - trap it via snmp?
From the CLI, the show mac, can show you a list of the MAC in the switch's table. So i believe if you have something tracks and save that list in a database it is possible, but i not sure how.
basically, once the MAC moved, the MAC list will be updated in the switch, and that also can be controlled by the MAC age time out.
Note: ----- With the IDM, you can actually do better than that, where you combine a flavor of security with the Time and Location then print out a full report for a day (or any period) shows you that USER's moves along your network based on the Switches and Ports also.
Seems that two MACs are "flapping" - possibly due to an error on a DSLAM. Will investigate further, this might be interresting for more than just me :o)
A lot of the time they're just flipping around because of some instability in the spanning-tree topology. Check your 'show span' to see if the time from the last topology change correlates to the time of the mac moves.
I disabled the VLAN in question on the customer's port, and everything went silent. I do not have spanning-tree enabled. This must be due to a flaw in either DSLAM or CPE.
Anyone knows how to turn on or
in this forum.. This would look much nicer then:
MAC moves/min 0 0 0 45 33 Low * * 0 0 0 High * * 0 1556 1556
In short it says that yesterday was bad, today is good.
