SW_MATM-4-MACFLAP_NOTIF

A few days ago I was performing a migration of our inter-switch connections from 1Gps single links to 4Gps aggregates, and this message appeared:

*Jun 23 04:58:11.888: %SW_MATM-4-MACFLAP_NOTIF: Host 0015.5d91.8502 in vlan 1 is flapping between port Gi0/20 and port Po1

Well… I shut the port Gi0/20 to have look at it…

After a few web searches, the most potential error was a loop:

Some of the port I used were originally 1G access ports. They were configured with portfast feature. Portfast disable spanning-tree checks and make the port move from blocking to forwarding state immediately.

However I plugged one cable on the wrong switch making a loop. STP was not able to react because of the portfast and the only errors that appeared were this MAC flapping messages.

It describes a MAC address that is continually changing between port Gi0/20 and Po1 in the MAC address table.

loop-mac-flap

Thanks to the quick shutdown of the faulty port and the storm-control, the stability of the network was not endangered.
This incident remained transparent for end users 😉

Note: this is message could have many significations depending of your environment.

Syslog message review:

*Jun 23 04:58:11.888:

– Timestamp: Month Day Hour:Minute:Second.Microseconds

%SW_MATM-4-MACFLAP_NOTIF:

– %SW_MATM: facility, MAC address management
– 4: severity, WARNING
– MACFLAP_NOTIF: Mnemonic, unique text string that describes the message

Host 0015.5d91.8502 in vlan 1 is flapping between port Gi0/20 and port Po1

– Detailed message

PacketLife talked about it : http://packetlife.net/blog/2009/oct/15/stp-your-friend/