MAC_MOVE / Port conflict?

[Nathaniel Muller]

I have 4 hosts running ProxmoxVE 4.4. Each machine has 8 NICS with those bonded into 4 pairs, one pair for each of our VLANS (100, 200, 300, and 400).
We recently replaced our old DELL switches with two new switches, with as identical configuration as possible.

Everything works fine, but we get one message from the switch that we did not in the past:
Aug 6 11:17:09 10.10.10.254 Aug 6 18:16:52 10.10.40.100-2 FDB[dtlAddrTask]: fdb.c(584) 71157 %% NOTE MAC_MOVE: Mac 0000.5E00.0001 in VLAN: 200 is overwritten from entryT
ype 1 to 1and port Gi2/0/26 to Gi1/0/14
Aug 6 11:17:20 10.10.10.254 Aug 6 18:17:03 10.10.40.100-2 FDB[dtlAddrTask]: fdb.c(584) 71158 %% NOTE MAC_MOVE: Mac 0000.5E00.0001 in VLAN: 200 is overwritten from entryT
ype 1 to 1and port Gi1/0/14 to Gi2/0/26

Gi1/0/14 is mapped to one of the bonded pairs connected to VLAN 200
Gi2/0/26 is mapped to a different server's bonded pair for VLAN 200.

I did try unplugging those cables, (since we have a bonded pair, no traffic is lost) but I just got the similar errors for VLAN 200 on the other servers.

This is odd because it's only happening for VLAN 200, where we have all 4 vlans configured the same way.
I'm also not able to identify where MAC 00:00:5e:00:00:01 comes from.

Any help would be appreciated.

 

[dcsapak]

you could try to see if some vm/ct has configured this mac. try to grep the mac in /etc/pve on a host

 

[Nathaniel Muller]

I've checked for that mac in the firewall's ARP table and also all the VMS.
I checked through all qemu (we only use qemu with two LXC) and cannot find that MAC. We have no instances of any macs that start with 00:00 or end with 00:01
The most weird thing about it, is that MAC_MOVE is reported between two different physical servers, if there were a VM attached to it it's like it would be moving between the hosts.

 

[dcsapak]

ok, it seems that this mac belongs to vrrp[0], do you have it configured in your network?

0: https://en.wikipedia.org/wiki/Virtual_Router_Redundancy_Protocol

 

[Nathaniel Muller]

I've checked the switches - We do not have VRRP configured on either of them.

But since you mentioned VRRP, our consultant said to check all CARP devices too, because they use the same MAC.
On a hunch - I checked two virtual pound Load Balancers I had running on Proxmox and they were having a CARP error.
I corrected the cluster and the MAC_MOVE stopped occurring.

The strange thing - I dont see any mention of that MAC when I look at those machines - nothing in the arp table or ifconfig listing.

And also strange, since the loadbalancers are virtualized, I'm surprised they'd even see the switch change.

Thanks! Problem solved!