2

Encountering a strange issue with a Cisco 3850 that is in use as a core switch. It is flooding all ports on the switch with traffic. After investigating more, it appears that the CAM table is not updating, and is empty aside from the built in addresses.

Using Cacti to monitor the interfaces, I can see a large amount of outbound traffic to each port, with no correlating incoming traffic on any of the other ports. I set up a monitor port and watched the traffic with wireshark, and I am seeing traffic that most certainly should not be on that port.

There dont appear to be any spanning tree issues that I can identify. I will be disabling uplinks one by one in a little bit to test.

I am still really confused why the switch is not populating the mac address-table, there is enough traffic that I would figure it would have updated by now.

    Output of 'show mac address-table'    
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
 All    0100.0ccc.cccc    STATIC      CPU
 All    0100.0ccc.cccd    STATIC      CPU
 All    0100.0ccc.ccce    STATIC      CPU
 All    0180.c200.0000    STATIC      CPU
 All    0180.c200.0001    STATIC      CPU
 All    0180.c200.0002    STATIC      CPU
 All    0180.c200.0003    STATIC      CPU
 All    0180.c200.0004    STATIC      CPU
 All    0180.c200.0005    STATIC      CPU
 All    0180.c200.0006    STATIC      CPU
 All    0180.c200.0007    STATIC      CPU
 All    0180.c200.0008    STATIC      CPU
 All    0180.c200.0009    STATIC      CPU
 All    0180.c200.000a    STATIC      CPU
 All    0180.c200.000b    STATIC      CPU
 All    0180.c200.000c    STATIC      CPU
 All    0180.c200.000d    STATIC      CPU
 All    0180.c200.000e    STATIC      CPU
 All    0180.c200.000f    STATIC      CPU
 All    0180.c200.0010    STATIC      CPU
 All    ffff.ffff.ffff    STATIC      CPU
   1    dca5.f433.1bc7    STATIC      Vl1
  10    dca5.f433.1bc6    STATIC      Vl10
  30    dca5.f433.1be5    STATIC      Vl30
  40    dca5.f433.1be4    STATIC      Vl40
  50    dca5.f433.1be8    STATIC      Vl50
  20    dca5.f433.1bd6    STATIC      Vl20
  15    dca5.f433.1bd4    STATIC      Vl15
Total Mac Addresses for this criterion: 28

Output of 'show mac address-table count'

Mac Entries for Vlan 1:
---------------------------
Dynamic Address Count  : 0
Static  Address Count  : 1
Total Mac Addresses    : 1

Mac Entries for Vlan 10:
---------------------------
Dynamic Address Count  : 0
Static  Address Count  : 1
Total Mac Addresses    : 1

Mac Entries for Vlan 30:
---------------------------
Dynamic Address Count  : 0
Static  Address Count  : 1
Total Mac Addresses    : 1

Mac Entries for Vlan 40:
---------------------------
Dynamic Address Count  : 0
Static  Address Count  : 1
Total Mac Addresses    : 1

Mac Entries for Vlan 50:
---------------------------
Dynamic Address Count  : 0
Static  Address Count  : 1
Total Mac Addresses    : 1

Mac Entries for Vlan 20:
---------------------------
Dynamic Address Count  : 0
Static  Address Count  : 1
Total Mac Addresses    : 1

Mac Entries for Vlan 99:
---------------------------
Dynamic Address Count  : 0
Static  Address Count  : 0
Total Mac Addresses    : 0

Mac Entries for Vlan 15:
---------------------------
Dynamic Address Count  : 0
Static  Address Count  : 1
Total Mac Addresses    : 1

Total Mac Address Space Available: 32752

Output of sh arp summary

Total number of entries in the ARP table: 424.
Total number of Dynamic ARP entries: 412.
Total number of Incomplete ARP entries: 3.
Total number of Interface ARP entries: 9.
Total number of Static ARP entries: 0.
Total number of Alias ARP entries: 0.
Total number of Simple Application ARP entries: 0.
Total number of Application Alias ARP entries: 0.
Total number of Application Timer ARP entries: 0.

Interface              Entry Count
Vlan15                           2
GigabitEthernet1/0/24            4
Vlan20                         124
LIIN0                            1
Vlan40                          40
Vlan30                          28
Vlan10                         222
GigabitEthernet1/0/1             3

Super confused here! Any ideas?

3
  • Shutting down uplinks to all other trunked switches did not resolve issue. Reloaded the switch and CAM table is now populated as it should. Still investigating root cause and waiting for confirmation that the traffic spamming has stopped.
    – James
    Jan 22, 2015 at 1:02
  • Traffic craziness has stopped, still cant figure out what happened.
    – James
    Jan 22, 2015 at 1:30
  • try juniper!!!! Feb 13, 2015 at 7:44

0

You must log in to answer this question.

Browse other questions tagged .