帮忙综合分析一下两台交换机的日志
- 0关注
- 0收藏，68浏览
问题描述：
%@97567%Apr 8 14:14:15:711 2026 Cqk_ShengChanWang_HeXin DRVPLAT/4/SOFTCAR DROP:
PktType=ARP, SrcMAC=f84d-fc44-790f, Dropped from interface=GigabitEthernet1/0/21 at Stage=9, StageCnt=2208, TotalCnt=86222, MaxRateInterface=GigabitEthernet1/0/21.
%@97568%Apr 8 16:55:44:376 2026 Cqk_ShengChanWang_HeXin DRVPLAT/4/SOFTCAR DROP:
PktType=ARP, SrcMAC=f84d-fc2a-cf68, Dropped from interface=GigabitEthernet1/0/21 at Stage=1, StageCnt=29, TotalCnt=86251, MaxRateInterface=GigabitEthernet1/0/21.
%@97569%Apr 8 17:48:17:766 2026 Cqk_ShengChanWang_HeXin LLDP/5/LLDP_NEIGHBOR_AGE_OUT: Nearest bridge agent neighbor aged out on port GigabitEthernet1/0/21 (IfIndex 21), neighbor's chassis ID is 94a6-d8ce-24ca, port ID is GigabitEthernet1/0/48.
%@97570%Apr 8 18:12:41:584 2026 Cqk_ShengChanWang_HeXin DRVPLAT/4/SOFTCAR DROP:
PktType=ARP, SrcMAC=807c-62ad-ca0a, Dropped from interface=GigabitEthernet1/0/21 at Stage=1, StageCnt=31, TotalCnt=86282, MaxRateInterface=GigabitEthernet1/0/24.
%@97571%Apr 8 18:12:41:629 2026 Cqk_ShengChanWang_HeXin STP/4/STP_DISPUTE: Instance 0's port GigabitEthernet1/0/21 received an inferior BPDU from a designated port which is in forwarding or learning state.
%@97572%Apr 8 18:12:41:632 2026 Cqk_ShengChanWang_HeXin LLDP/6/LLDP_CREATE_NEIGHBOR: Nearest bridge agent neighbor created on port GigabitEthernet1/0/21 (IfIndex 21), neighbor's chassis ID is 94a6-d8ce-24ca, port ID is GigabitEthernet1/0/48.
%@97573%Apr 8 18:22:08:052 2026 Cqk_ShengChanWang_HeXin STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/22 was notified a topology change.
%@97574%Apr 8 18:22:48:053 2026 Cqk_ShengChanWang_HeXin STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/22 was notified a topology change.
%@97575%Apr 9 09:37:06:946 2026 Cqk_ShengChanWang_HeXin DRVPLAT/4/SOFTCAR DROP:
PktType=ARP, SrcMAC=f84d-fc3b-21d7, Dropped from interface=GigabitEthernet1/0/21 at Stage=1, StageCnt=397, TotalCnt=86679, MaxRateInterface=GigabitEthernet1/0/21.
%@97576%Apr 9 10:52:25:365 2026 Cqk_ShengChanWang_HeXin STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/22 was notified a topology change.
%@97577%Apr 9 11:14:12:358 2026 Cqk_ShengChanWang_HeXin STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/22 was notified a topology change.
%@97578%Apr 9 11:18:41:360 2026 Cqk_ShengChanWang_HeXin STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/22 was notified a topology change.
%@97579%Apr 9 11:18:48:382 2026 Cqk_ShengChanWang_HeXin SSHS/6/SSHS_AUTH_PWD_FAIL: Authentication failed for user admin from 172.16.9.4 port 3081 because of invalid username or wrong password.
%@97580%Apr 9 11:19:16:387 2026 Cqk_ShengChanWang_HeXin SSHS/6/SSHS_AUTH_PWD_FAIL: Authentication failed for user admin from 172.16.9.4 port 3081 because of invalid username or wrong password.
%@97581%Apr 9 11:19:24:591 2026 Cqk_ShengChanWang_HeXin SSHS/6/SSHS_AUTH_SUCCESS: SSH user admin from 172.16.9.4 port 3081 passed password authentication.
%@97582%Apr 9 11:19:25:652 2026 Cqk_ShengChanWang_HeXin SSHS/6/SSHS_CONNECT: SSH user admin (IP: 172.16.9.4) connected to the server successfully.
%@97583%Apr 9 11:19:26:945 2026 Cqk_ShengChanWang_HeXin SHELL/5/SHELL_LOGIN: admin logged in from 172.16.9.4.
这是核心交换机
<Sqcqk_huiju>dis logfile bu
<Sqcqk_huiju>dis logfile buffer
%@13820%Apr 8 17:46:11:363 2026 Sqcqk_huiju STP/5/STP_BPDU_RECEIVE_EXPIRY: Instance 0's port GigabitEthernet1/0/48 received no BPDU within the rcvdInfoWhile interval. Information of the port aged out.
%@13821%Apr 8 17:46:11:396 2026 Sqcqk_huiju STP/5/STP_NOT_ROOT: The current switch is no longer the root of Instance 0.
%@13822%Apr 8 17:46:11:416 2026 Sqcqk_huiju STP/4/STP_DISPUTE: Instance 0's port GigabitEthernet1/0/41 received an inferior BPDU from a designated port which is in forwarding or learning state. The designated bridge ID contained in the BPDU is 32768.9018-ae1d-eaef, and the designated port ID contained in the BPDU is 128.11.
%@13823%Apr 8 17:46:11:417 2026 Sqcqk_huiju STP/6/STP_DISCARDING: Instance 0's port GigabitEthernet1/0/41 has been set to discarding state.
%@13824%Apr 8 17:46:11:746 2026 Sqcqk_huiju STP/6/STP_DISPUTE_RESTORATION: Instance 0's port GigabitEthernet1/0/41 exited the dispute state.
%@13825%Apr 8 17:46:11:747 2026 Sqcqk_huiju STP/6/STP_FORWARDING: Instance 0's port GigabitEthernet1/0/41 has been set to forwarding state.
%@13826%Apr 8 17:46:30:374 2026 Sqcqk_huiju STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/24 was notified a topology change.
%@13827%Apr 8 17:47:39:638 2026 Sqcqk_huiju LLDP/5/LLDP_NEIGHBOR_AGE_OUT: Nearest bridge agent neighbor aged out on port GigabitEthernet1/0/48 (IfIndex 48), neighbor's chassis ID is 305f-772f-4684, port ID is GigabitEthernet1/0/21.
%@13828%Apr 8 18:12:09:452 2026 Sqcqk_huiju LLDP/6/LLDP_CREATE_NEIGHBOR: Nearest bridge agent neighbor created on port GigabitEthernet1/0/48 (IfIndex 48), neighbor's chassis ID is 305f-772f-4684, port ID is GigabitEthernet1/0/21.
%@13829%Apr 8 18:12:09:646 2026 Sqcqk_huiju STP/6/STP_DISCARDING: Instance 0's port GigabitEthernet1/0/24 has been set to discarding state.
%@13830%Apr 8 18:12:09:647 2026 Sqcqk_huiju STP/6/STP_DISCARDING: Instance 0's port GigabitEthernet1/0/38 has been set to discarding state.
%@13831%Apr 8 18:12:40:365 2026 Sqcqk_huiju STP/6/STP_FORWARDING: Instance 0's port GigabitEthernet1/0/24 has been set to forwarding state.
%@13832%Apr 8 18:12:40:367 2026 Sqcqk_huiju STP/6/STP_FORWARDING: Instance 0's port GigabitEthernet1/0/38 has been set to forwarding state.
%@13833%Apr 8 18:21:36:042 2026 Sqcqk_huiju STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/48 was notified a topology change.
%@13834%Apr 8 18:21:38:300 2026 Sqcqk_huiju STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/48 was notified a topology change.
%@13835%Apr 8 18:22:15:961 2026 Sqcqk_huiju STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/48 was notified a topology change.
%@13836%Apr 8 18:22:18:300 2026 Sqcqk_huiju STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/48 was notified a topology change.
%@13837%Apr 9 10:51:54:141 2026 Sqcqk_huiju STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/48 was notified a topology change.
%@13838%Apr 9 10:51:56:174 2026 Sqcqk_huiju STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/48 was notified a topology change.
%@13839%Apr 9 11:13:41:156 2026 Sqcqk_huiju STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/48 was notified a topology change.
%@13840%Apr 9 11:13:43:193 2026 Sqcqk_huiju STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/48 was notified a topology change.
%@13841%Apr 9 11:15:31:042 2026 Sqcqk_huiju SHELL/5/SHELL_LOGIN: TTY logged in from aux0.
%@13842%Apr 9 11:16:09:213 2026 Sqcqk_huiju SHELL/6/SHELL_CMD: -Line=aux0-IPAddr=**-User=**; Command is dis vl all
%@13843%Apr 9 11:16:28:321 2026 Sqcqk_huiju SHELL/6/SHELL_CMD: -Line=aux0-IPAddr=**-User=**; Command is ssh 172.19.9.1
%@13844%Apr 9 11:16:47:373 2026 Sqcqk_huiju SHELL/6/SHELL_CMD_INPUT: Input string for the ssh 172.19.9.1 command is admin.
%@13845%Apr 9 11:17:59:018 2026 Sqcqk_huiju SHELL/6/SHELL_CMD: -Line=aux0-IPAddr=**-User=**; Command is ssh 172.16.9.1
%@13846%Apr 9 11:18:04:389 2026 Sqcqk_huiju SHELL/6/SHELL_CMD_INPUT: Input string for the ssh 172.16.9.1 command is admin.
%@13847%Apr 9 11:18:10:159 2026 Sqcqk_huiju STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/48 was notified a topology change.
%@13848%Apr 9 11:18:12:197 2026 Sqcqk_huiju STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/48 was notified a topology change.
%@13849%Apr 9 11:32:54:393 2026 Sqcqk_huiju SHELL/6/SHELL_CMD: -Line=aux0-IPAddr=**-User=**; Command is ssh 172.16.9.1
%@13850%Apr 9 11:33:12:497 2026 Sqcqk_huiju SHELL/6/SHELL_CMD_INPUT: Input string for the ssh 172.16.9.1 command is admin.
%@13851%Apr 9 12:06:56:125 2026 Sqcqk_huiju SHELL/5/SHELL_LOGOUT: TTY logged out from aux0.
%@13852%Apr 9 13:39:12:207 2026 Sqcqk_huiju STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/48 was notified a topology change.
%@13853%Apr 9 13:39:14:321 2026 Sqcqk_huiju STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/48 was notified a topology change.
%@13854%Apr 9 14:07:40:219 2026 Sqcqk_huiju STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/48 was notified a topology change.
%@13855%Apr 9 14:07:42:404 2026 Sqcqk_huiju STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/48 was notified a topology change.
%@13856%Apr 9 14:57:06:239 2026 Sqcqk_huiju STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/48 was notified a topology change.
%@13857%Apr 9 14:57:08:402 2026 Sqcqk_huiju STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/48 was notified a topology change.
%@13858%Apr 9 15:08:43:243 2026 Sqcqk_huiju STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/48 was notified a topology change.
%@13859%Apr 9 15:08:45:402 2026 Sqcqk_huiju STP/6/STP_NOTIFIED_TC: Instance 0's port GigabitEthernet1/0/48 was notified a topology change.
%@13860%Apr 9 15:11:40:003 2026 Sqcqk_huiju SSHS/6/SSHS_AUTH_SUCCESS: SSH user admin from 172.16.9.1 port 39168 passed password authentication.
%@13861%Apr 9 15:11:40:065 2026 Sqcqk_huiju SSHS/6/SSHS_CONNECT: SSH user admin (IP: 172.16.9.1) connected to the server successfully.
%@13862%Apr 9 15:11:40:463 2026 Sqcqk_huiju SHELL/5/SHELL_LOGIN: admin logged in from 172.16.9.1.
%@13863%Apr 9 15:11:48:509 2026 Sqcqk_huiju SHELL/6/SHELL_CMD: -Line=vty0-IPAddr=172.16.9.1-User=admin; Command is dis clock
这是接入交换机
结合核心交换机 Cqk_ShengChanWang_HeXin 和汇聚交换机 Sqcqk_huiju 的日志，可以明确判断：两台交换机之间的互联链路（核心G1/0/21 ↔ 汇聚G1/0/48）存在严重的不稳定性，并引发了STP震荡、ARP丢包、TC通知泛滥等一系列问题。
根本原因分析
1. 直接原因：互联链路物理或电气层不稳定
可能原因：光纤/网线接触不良、光模块老化或故障、端口自协商异常、双工不匹配。
表现为：BPDU 和 LLDP 报文周期性丢失，触发 STP 的
rcvdInfoWhile超时，导致端口角色重新计算。
2. 间接原因：STP 配置或设计缺陷
汇聚交换机曾为根桥：日志显示
STP_NOT_ROOT，说明原先汇聚是根桥，核心可能不是。如果根桥在下游，链路抖动时会引发更复杂的 dispute。缺少 BPDU 保护：未启用
bpdu-protection或bpdu-drop，导致劣质 BPDU 进入并触发 dispute。路径开销标准不一致：华为与 H3C 混合组网时，若
stp pathcost-standard不一致（如 legacy vs dot1t），会导致端口角色计算错误，诱发 dispute。
3. 后果：ARP 丢包与 TC 泛滥
链路抖动期间，大量 ARP 广播包涌入，超出 CPU 保护阈值（SOFTCAR），被丢弃。
频繁的 TC 通知导致全网 MAC 地址表反复老化，增加广播流量，进一步加剧 CPU 负担。
STP dispute 会使端口进入 discarding 状态，造成业务中断。
立即措施（业务窗口内执行）
隔离故障链路：
shutdown核心 G1/0/21 和汇聚 G1/0/48，观察网络是否恢复稳定（确认故障源）。更换物理介质：替换光纤/网线、光模块，清洁接口，重新开启并检查协商状态（
display interface确认无 CRC 错误）。临时关闭 STP dispute 保护（仅用于紧急恢复，治标不治本）：
[H3C-GigabitEthernet1/0/21] undo stp dispute-protection（两端均需配置）[H3C] interface GigabitEthernet1/0/21
根本修复（计划维护窗口）
统一 STP 模式与开销标准：
确认两端都使用 RSTP 或 MSTP，并确保域配置一致。
在 H3C 设备上执行：
stp pathcost-standard dot1t（若对端为华为默认标准）。
明确根桥位置：
将核心交换机设置为根桥（优先级 0 或 4096），汇聚为备份根桥（优先级 8192）。
启用环路保护与 BPDU 过滤：
在接入端口启用
stp bpdu-protection。在互联端口启用
stp loop-protection。
优化 ARP 限速：
全局或接口下配置：
arp rate-limit 100（根据实际流量调整）。
升级软件版本：检查是否有已知的 STP dispute 或 SOFTCAR 丢包 bug，升级至官方推荐版本。
验证方法
执行
display stp brief确认所有端口为FORWARDING。执行
display stp abnormal-port确认无 dispute 记录。观察
display logbuffer | include DRVPLAT，确认 ARP 丢包计数不再增长。使用
display interface | include CRC检查物理层错误。
整体结论（非常明确）
一、日志里的铁证（逐条对应）
1. 核心交换机日志
- 大量 SOFTCAR DROP ARP 报文
- 来自端口：
GigabitEthernet1/0/21 - 原因：ARP 泛洪、环路导致流量突增，交换机限速丢包
- 来自端口：
- STP DISPUTE 冲突
Instance 0's port GigabitEthernet1/0/21 received an inferior BPDU…→ 典型环路 / 双归链路导致的 BPDU 冲突
- LLDP 邻居反复老化、重新建立
17:48 LLDP 老化 → 18:12 重新发现→ 互联链路反复闪断 / 震荡
- 持续 TC 拓扑变更
STP_NOTIFIED_TC刷屏→ 网络拓扑一直在变，MAC 表反复刷新
2. 接入交换机日志
- G1/0/48 端口 BPDU 超时、根桥变更
17:46:11 不再是根桥→ STP 重新计算，环路触发根桥切换
- G1/0/48 持续 TC 刷屏
- 从 18 点到第二天 15 点一直在报 TC→ 这条上行链路一直在震荡
- 端口反复 DISCARDING ↔ FORWARDING→ STP 为了破环，反复堵端口、放开端口
二、真实故障场景（99% 就是这个）
- 核心 ←→ 接入
- 两台交换机之间不止一条物理链路，或存在隐性环路
- 可能是：
- 双上联 / 聚合口配置错误
- 下联终端又回插了一条线到同一台交换机（小环路）
- 无线 AP、傻瓜交换机、私接路由器形成二层环
- STP 配置不统一（核心 / 接入优先级不一致、path cost 混乱）
- 偶尔卡顿
- ARP 丢包
- 终端偶尔掉线
- 网速忽快忽慢
- 日志疯狂刷 TC
三、最精准定位（直接告诉你查哪里）
故障点锁定
立刻要做的 3 件事
1. 查下联是否有环路
display interface GigabitEthernet1/0/21
display stp GigabitEthernet1/0/21
- 有无 错包、广播突增
- STP 状态是否 反复切换
2. 查接入交换机下联口
display stp tc
3. 检查是否做了聚合
四、最简快速修复方案（现场最有效）
1. 开启环路保护（必开）
stp loop-protection
2. 互联口开启 BPDU 保护
interface GigabitEthernet1/0/21
stp edged-port disable
stp bpdu-protection
3. 下联口全部开边缘端口 + BPDU 保护
interface range GigabitEthernet1/0/1 to 47
stp edged-port enable
stp bpdu-protection
4. 统一根桥
stp root primary
stp root secondary
五、一句话总结
暂无评论
编辑答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论