一次err-disable环路的处理
Oct 6 20:07:57 cn-pek1-16-2960g-1.cnet.com 4507: Oct 6 12:17:51: %SW_MATM-4-MACFLAP_NOTIF: Host 0002.7e8c.2c19 in vlan 382 is flapping between port Gi0/23 and port Gi0/24
Oct 6 20:08:02 cn-pek1-16-2960g-1.cnet.com 4508: Oct 6 12:17:52: %SW_MATM-4-MACFLAP_NOTIF: Host 0015.63c2.efb9 in vlan 370 is flapping between port Gi0/23 and port Gi0/24
Oct 6 20:08:07 cn-pek1-16-2960g-1.cnet.com 4509: Oct 6 12:17:52: %SW_MATM-4-MACFLAP_NOTIF: Host 0014.6a89.afc9 in vlan 370 is flapping between port Gi0/23 and port Gi0/24
Oct 6 20:08:12 cn-pek1-16-2960g-1.cnet.com 4510: Oct 6 12:17:53: %SW_MATM-4-MACFLAP_NOTIF: Host 0018.741d.7f00 in vlan 378 is flapping between port Gi0/23 and port Gi0/21
Oct 6 20:08:17 cn-pek1-16-2960g-1.cnet.com 4520: Oct 6 12:18:23: %SW_MATM-4-MACFLAP_NOTIF: Host 0018.199d.e31a in vlan 370 is flapping between port Gi0/23 and port Gi0/24
Oct 6 20:08:22 cn-pek1-16-2960g-1.cnet.com 4521: Oct 6 12:18:23: %SW_MATM-4-MACFLAP_NOTIF: Host 0015.63c2.efb9 in vlan 370 is flapping between port Gi0/23 and port Gi0/24
Oct 6 20:08:27 cn-pek1-16-2960g-1.cnet.com 4522: Oct 6 12:18:23: %SW_MATM-4-MACFLAP_NOTIF: Host 0090.0b08.2ab9 in vlan 370 is flapping between port Gi0/24 and port Gi0/23
Oct 6 20:08:32 cn-pek1-16-2960g-1.cnet.com 4523: Oct 6 12:18:25: %SW_MATM-4-MACFLAP_NOTIF: Host 0013.46e2.4dc0 in vlan 370 is flapping between port Gi0/24 and port Gi0/23
Oct 6 20:08:37 cn-pek1-16-2960g-1.cnet.com 4524: Oct 6 12:18:29: %SW_MATM-4-MACFLAP_NOTIF: Host 000c.767e.6a23 in vlan 370 is flapping between port Gi0/24 and port Gi0/23
Oct 6 20:08:42 cn-pek1-16-2960g-1.cnet.com 4525: Oct 6 12:18:31: %SW_MATM-4-MACFLAP_NOTIF: Host 0002.7e8c.2c1a in vlan 370 is flapping between port Gi0/23 and port Gi0/24
公司不止一台交换机出现这样的log,且接入层层里的所有百兆交换机的上联口全部err-disable状态,导致全公司断网,于是写脚本收集所有分布层交换机的日志,发现一些很重要的信息,Oct 6 13:38:23: %SW_MATM-4-MACFLAP_NOTIF: Host 0002.7e8c.2c19 in vlan 376 is flapping between port Fa0/6 and port Fa0/34
Oct 6 13:38:23: %SW_MATM-4-MACFLAP_NOTIF: Host 000f.e200.1205 in vlan 376 is flapping between port Fa0/6 and port Fa0/34
Oct 6 13:38:23: %SW_MATM-4-MACFLAP_NOTIF: Host 0007.e9d6.744d in vlan 376 is flapping between port Fa0/6 and port Fa0/34
注意,这个和以上的log不同之处在于,重复的mac地址不是来自下联员工pc和上联分布层交换机,而只是来自不同的下联员工pc,所以打环之处肯定在这里。于是顺藤摸瓜,找到了原因,员工擅自接了两个傻瓜交换机,且两个交换机的均直接接在接入层的cisco 2960交换机=。=!
err-disable虽然开启了recovery,但是环路的影响还是很大的,故应该分析找到具体的原因所在,这也是老大教导我们的方法之一。
阅读(1279) | 评论(0) | 转发(0) |