Unsolved Port Security Violations

---

Hey guys I am a little stumped here I have port security enabled on my switch with a maximum 1 MAC address sticky and I am getting a ton of security violations on only some ports but not all. Any help would be appreciated. Thanks.

Output:
#show port-security
Secure Port MaxSecureAddr CurrentAddr SecurityViolation Security Action
(Count) (Count) (Count)

  Fa0/1              1            0                  0         Restrict
  Fa0/2              1            0                  0         Restrict
  Fa0/3              1            0                  0         Restrict
  Fa0/4              1            0                  0         Restrict
  Fa0/5              1            0                  0         Restrict
  Fa0/6              1            0                  0         Restrict
  Fa0/7              1            0                  0         Restrict
  Fa0/8              1            0                  0         Restrict
  Fa0/9              1            0                  0         Restrict
 Fa0/10              1            0                  0         Restrict
 Fa0/11              1            0                  0         Restrict
 Fa0/12              1            0                  0         Restrict
 Fa0/13              1            1                  0         Restrict
 Fa0/14              1            1                 12         Restrict
 Fa0/15              1            1                  0         Restrict
 Fa0/16              1            1               1780         Restrict
 Fa0/17              1            1                  2         Restrict
 Fa0/18              1            1               4379         Restrict
 Fa0/19              1            1               3706         Restrict
 Fa0/20              1            1                  0         Restrict
 Fa0/21              1            1                172         Restrict
 Fa0/22              1            0                  0         Restrict
 Fa0/23              1            1                  0         Restrict
 Fa0/24              1            1                  0         Restrict
 Fa0/25              1            1                  0         Restrict
 Fa0/26              1            1              68698         Restrict
 Fa0/27              1            1                  0         Restrict
 Fa0/28              1            0                  0         Restrict
 Fa0/29              1            0                  0         Restrict
 Fa0/30              1            1             205727         Restrict
 Fa0/31              1            1                276         Restrict
 Fa0/32              1            1                476         Restrict
 Fa0/33              1            1                  0         Restrict
 Fa0/34              1            0                  0         Restrict
 Fa0/35              1            1                  0         Restrict
 Fa0/36              1            1              57213         Restrict
 Fa0/37              1            1                  0         Restrict
 Fa0/38              1            1                  0         Restrict
 Fa0/39              1            1                 49         Restrict
 Fa0/40              1            1                  0         Restrict
 Fa0/41              1            1              28383         Restrict
 Fa0/42              1            1                  0         Restrict
 Fa0/43              1            1              22621         Restrict
 Fa0/44              1            1                  0         Restrict
 Fa0/45              1            1                  0         Restrict

Total Addresses in System (excluding one mac per port) : 0
Max Addresses limit in System (excluding one mac per port) : 1024

What devices do you have connected to the ports?

Mainly PC's

@kyle-thompson

Let us find out a little about your topology, what is attached directly to fa0/16-19 and fa0/21, fa0/26, fa0/30-32, fa0/36, fa0/41 and fa0/43.

Switches? hubs?, wireless ap?,

@Ronnie-Wong

F0/16 - Dell PC
F0/17 - Dell PC
F0/18- Dell PC
F0/19 -Dell PC

F0/21 - Dell PC
F0/26 - Dell PC

F0/30 - Dell PC
F0/31 - Dell PC
F0/32 - Dell PC

F0/36 - Dell PC

F0/41- Dell PC

F0/43 - Dell PC

F0/46 and F0/48 are a EtherChannel to another switch.

@kyle-thompson,

I would suspect that you have some malware on those Dell PC that are trying to do some kind of flooding attack.

I would take one of those ports like fa0/43. show the last mac address violation and compare it the MAC on the PC's NIC. If they are different, then you know that machine is sending out more than one MAC address from a single NIC. It's a telltale sign.