Cisco switch: trunk port MAC address disappears from MAC address table

I have users complaining of slowness on their machines but we can't find anything specific (ping tests, etc). I'm trying to rule out the connection between the switch they're plugged into (3560) and the core switch (a stack of 3570s).

Currently the 3560 has one fiber connection trunked back to core switch. When tracing the trunk port back through the network I run into the odd issue of the MAC address of the 3560's trunk port disappearing from the MAC address table in the core switch. In the output below Switch1 is the core switch stack and Switch4 is the switch I'm investigating.

Switch4#sh int tru

Port        Mode             Encapsulation  Status        Native vlan
Gi1/2       on               802.1q         trunking      1

Port        Vlans allowed on trunk
Gi1/2       1-4094

Port        Vlans allowed and active in management domain
Gi1/2       1-2,30,40,42,50,60,70,72,80,82,99-100,102,254

Port        Vlans in spanning tree forwarding state and not pruned
Gi1/2       1-2,30,40,42,50,60,70,72,80,82,99-100,102,254
Switch4#sh int gi1/2
GigabitEthernet1/2 is up, line protocol is up (connected)
  Hardware is Gigabit Ethernet, address is XXXX.dbd3.f0b2 (bia 30e4.dbd3.f0b2)

Confirming which port is trunked back to Switch1

=======
Switch1#sh mac address-table | inc f0b2
   1    XXXX.dbd3.f0b2    DYNAMIC     Gi2/1/3
Switch1#sh mac address-table | inc f0b2
   1    XXXX.dbd3.f0b2    DYNAMIC     Gi2/1/3

The mac address shows up when I search for it

Switch1#sh mac address-table | inc f0b2
Switch1#sh mac

The mac address doesn't show up suddenly

Switch1#sh mac address-table | inc Gi2/1/3
   1    XXXX.dbd3.f0b2    DYNAMIC     Gi2/1/3
   1    XXXX.480e.2751    DYNAMIC     Gi2/1/3
  40    XXXX.11a0.5372    DYNAMIC     Gi2/1/3
  70    XXXX.5f0e.a116    DYNAMIC     Gi2/1/3
  80    XXXX.b6da.d050    DYNAMIC     Gi2/1/3
 100    XXXX.dbd3.f0c1    DYNAMIC     Gi2/1/3

The mac address shows up in the table now

Switch1#sh mac address-table | inc f0b2  
   1    XXXX.dbd3.f0b2    DYNAMIC     Gi2/1/3

The mac address shows up when I search for it again

Switch1#sh mac address-table | inc f0b2

Then it doesn't

Switch1#sh mac address-table | inc Gi2/1/3
   1    XXXX.480e.2751    DYNAMIC     Gi2/1/3
  40    XXXX.11a0.5372    DYNAMIC     Gi2/1/3
  70    XXXX.5f0e.a116    DYNAMIC     Gi2/1/3
  80    XXXX.b6da.d050    DYNAMIC     Gi2/1/3
 100    XXXX.dbd3.f0c1    DYNAMIC     Gi2/1/3

And it doesn't show up in the mac address table now

Switch1#sh mac address-table | inc f0b2  
   1    XXXX.dbd3.f0b2    DYNAMIC     Gi2/1/3

Now it's back

Can anyone explain why this behavior is going on? I've checked on a few more trunk ports between my switches and I don't run into the "disappearing mac address" issue.
travisryanAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Don JohnstonInstructorCommented:
Three questions:

1) How much time between issuing the "show mac" commands?
2) Is Switch1, Gi2/1/3 connected to Switch4 Gi1/2?
3) Are you sure there is no other path from Switch1 to this host?
lruiz52Commented:
I would try to shutdown both trunk ports then turn then on again and let them re-negotiate the trunk. See if that clears up the issue.

Config t
Int g1/2
Shut

Config t
Int g2/1/3
Shut

Then "no shut" on both
travisryanAuthor Commented:
Don, to answer your questions in order:

1) Not much time between issuing the commands, less than a minute.
2) Those switches are connected by one fiber pair
3) There was another path from switch4 to switch1 until recently, I shut that interface off.

lruiz, I think in connection with the answer to Don's last question I should restart those interfaces.
Netman66Commented:
Unless something pings an IP connected to that MAC, the arp table will flush and the MAC disappears until something causes it to get cached again (like a ping - as above).

When users complain about "slow" networks, it doesn't necessarily mean there is anything wrong with the actual network.  It may be some localized PC issue.  We have users complain all the time of a "slow network" when my monitoring tools tell me we are running at less than 2% on a 10GB backbone I know it isn't the network.  

We normally find issues where the "recent" list in Windows contains files that have either moved or been deleted and it constantly tries to refresh the list until it times out.  Other issues are the User's Home drive permissions, and yet others stem from sites outside our own LAN that are slow or inaccessible.

Just ensure you have a default gateway configured for your switches so that they are accessible and check out all your L2 and L3 interfaces to ensure they're setup right and I would be surprised if your network was to blame at all.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
travisryanAuthor Commented:
Thanks for the thorough answer.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Switches / Hubs

From novice to tech pro — start learning today.