Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm slowly locking down the network I've inherited and mac-flapping has been a problem in the past with customers doing all kinds of crazy things. Thats changing but I am now encountering this error:

Dec 30 18:31:31 1565: 001567: Dec 30 18:31:30: %SW_MATM-4-MACFLAP_NOTIF: Host xxxx.xxxx.f681 in vlan 1 is flapping between port Gi0/5 and port Gi0/48
Dec 30 18:43:28 1566: 001568: Dec 30 18:43:26: %SPANTREE-2-RECV_BAD_TLV: Received SSTP BPDU with bad TLV on GigabitEthernet0/5 VLAN1.
Dec 30 18:48:18 1567: 001569: .Dec 30 18:48:17: %SPANTREE-2-RECV_BAD_TLV: Received SSTP BPDU with bad TLV on GigabitEthernet0/5 VLAN1.

unfortunately, that mac address is the mac of our core router, the only link to the internet, on port gi0/48

On the other end of gi0/5, I have about 50 bridged customer machines connected through a series of managed and unmanaged L2 switches. Yes, on VLAN1 too ... like I said, working on changing this slowly. In the mean time, it has me quite baffled on how to deal with this and track down the customer or switch that is the problem. What else could be going on with these messages ... the bad TLV is a new one for me. Any ideas?

Thank you and Happy New Year to you all!!

share|improve this question
up vote 1 down vote accepted

For the MAC flapping, I'd wait until it re-occurs, then quickly gather the MAC forwarding table from all your managed routers (alternatively, gather them every 5-10 minutes and hope that the interesting bits are there, when you go check "after the fact"). It's either a duplicate MAC or a layer 2 forwarding loop.

The TLV error message indicates that the switch-port is expecting spanning tree BPDUs with dot1q VLAN IDs, but are getting some without a VLAN ID, the BPDU is dropped, but it means you have at least one switch hanging off that port that isn't running VLAN(s) on at least one port.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.