Layer 2 multicast address (arp)

[jgeralsky]

Hello,

During the packet capture we determine , that packets (multicast) from me_core(Campus core Switch) are flooded to all access switches trough the portchannels.

What kind of multicast address  is 01:00:0c:cd:cd:cd ? 

Do you have an idea, what could cause this?

Please check the attachment.

Many thanks,

Jan

[burleyman]

That looks like a Cisco proprietary multicast address might have to do with CDP. I am not 100% on though.

[burleyman]

Not sure about the CDP but this might lead you down a path.

When the Layer 2 PDUs that entered the Service Provider inbound edge switch through the tunnel port or the access port exit through its the trunk port into the Service Provider network, the switch overwrites the customer PDU-destination MAC address with a well-known Cisco proprietary multicast address (01-00-0c-cd-cd-d0).

It is close.

I got this information from

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/31sga/configuration/guide/config/tunnel.html

[PatrickDeMuynck1115]

Mis-cabling protocol used by Cisco ACI.  See slide in attach.