一次err-disable环路的处理-转

一次err-disable环路的处理

 

Oct 6 20:07:57 cn-pek1-16-2960g-1.cnet.com 4507: Oct 6 12:17:51: %SW_MATM-4-MACFLAP_NOTIF: Host 0002.7e8c.2c19 in vlan 382 is flapping between port Gi0/23 and port Gi0/24
Oct 6 20:08:02 cn-pek1-16-2960g-1.cnet.com 4508: Oct 6 12:17:52: %SW_MATM-4-MACFLAP_NOTIF: Host 0015.63c2.efb9 in vlan 370 is flapping between port Gi0/23 and port Gi0/24
Oct 6 20:08:07 cn-pek1-16-2960g-1.cnet.com 4509: Oct 6 12:17:52: %SW_MATM-4-MACFLAP_NOTIF: Host 0014.6a89.afc9 in vlan 370 is flapping between port Gi0/23 and port Gi0/24
Oct 6 20:08:12 cn-pek1-16-2960g-1.cnet.com 4510: Oct 6 12:17:53: %SW_MATM-4-MACFLAP_NOTIF: Host 0018.741d.7f00 in vlan 378 is flapping between port Gi0/23 and port Gi0/21
Oct 6 20:08:17 cn-pek1-16-2960g-1.cnet.com 4520: Oct 6 12:18:23: %SW_MATM-4-MACFLAP_NOTIF: Host 0018.199d.e31a in vlan 370 is flapping between port Gi0/23 and port Gi0/24
Oct 6 20:08:22 cn-pek1-16-2960g-1.cnet.com 4521: Oct 6 12:18:23: %SW_MATM-4-MACFLAP_NOTIF: Host 0015.63c2.efb9 in vlan 370 is flapping between port Gi0/23 and port Gi0/24
Oct 6 20:08:27 cn-pek1-16-2960g-1.cnet.com 4522: Oct 6 12:18:23: %SW_MATM-4-MACFLAP_NOTIF: Host 0090.0b08.2ab9 in vlan 370 is flapping between port Gi0/24 and port Gi0/23
Oct 6 20:08:32 cn-pek1-16-2960g-1.cnet.com 4523: Oct 6 12:18:25: %SW_MATM-4-MACFLAP_NOTIF: Host 0013.46e2.4dc0 in vlan 370 is flapping between port Gi0/24 and port Gi0/23
Oct 6 20:08:37 cn-pek1-16-2960g-1.cnet.com 4524: Oct 6 12:18:29: %SW_MATM-4-MACFLAP_NOTIF: Host 000c.767e.6a23 in vlan 370 is flapping between port Gi0/24 and port Gi0/23
Oct 6 20:08:42 cn-pek1-16-2960g-1.cnet.com 4525: Oct 6 12:18:31: %SW_MATM-4-MACFLAP_NOTIF: Host 0002.7e8c.2c1a in vlan 370 is flapping between port Gi0/23 and port Gi0/24

公司不止一台交换机出现这样的log,且接入层层里的所有百兆交换机的上联口全部err-disable状态，导致全公司断网，于是写脚本收集所有分布层交换机的日志，发现一些很重要的信息，Oct 6 13:38:23: %SW_MATM-4-MACFLAP_NOTIF: Host 0002.7e8c.2c19 in vlan 376 is flapping between port Fa0/6 and port Fa0/34
Oct 6 13:38:23: %SW_MATM-4-MACFLAP_NOTIF: Host 000f.e200.1205 in vlan 376 is flapping between port Fa0/6 and port Fa0/34
Oct 6 13:38:23: %SW_MATM-4-MACFLAP_NOTIF: Host 0007.e9d6.744d in vlan 376 is flapping between port Fa0/6 and port Fa0/34

注意，这个和以上的log不同之处在于，重复的mac地址不是来自下联员工pc和上联分布层交换机，而只是来自不同的下联员工pc，所以打环之处肯定在这里。于是顺藤摸瓜，找到了原因，员工擅自接了两个傻瓜交换机，且两个交换机的均直接接在接入层的cisco 2960交换机=。=！

err-disable虽然开启了recovery，但是环路的影响还是很大的，故应该分析找到具体的原因所在，这也是老大教导我们的方法之一。