You see MAC flapping messages in the log. What do they mean and what causes them?
Show the answer
Say this first
The switch keeps learning the same MAC in the same VLAN on two different ports, back and forth.
%SW_MATM-4-MACFLAP_NOTIF names the MAC, the VLAN and both ports. A single move is normal (a VM or a
laptop moved). Constant flapping usually means a layer 2 loop, an EtherChannel bundled on one side only,
server NIC teaming sending one MAC out two independent ports, or two FHRP routers both active.
Go deeper
%SW_MATM-4-MACFLAP_NOTIF: Host 0050.56a1.2c3d in vlan 10 is flapping between port Gi1/0/12 and port Gi1/0/47Read the pattern
- Many MACs, between an uplink and some access port, high CPU, line-rate broadcast: a loop. Contain it first by shutting the access port, then find out why STP did not block.
- One or two MACs, between two ports cabled to the same server: NIC teaming or Linux bonding in a mode that needs a port-channel (balance-rr, balance-xor, 802.3ad) against plain access ports. Fix it with LACP on both sides or switch to active-backup.
- MACs moving between the members of what should be a bundle: the far side is not bundled.
- The HSRP virtual MAC flapping between two uplinks: both routers think they are active, usually because their hellos do not reach each other.
Tools
show mac address-table address 0050.56a1.2c3d shows where it is now. Follow the MAC hop by hop
toward the port where it really lives, and look at show spanning-tree and interface rates along the way.
They will ask next
Does the switch stop the flapping by itself?
On Catalyst it is only a log message. Some platforms, such as Nexus, can be configured to shut a port when a MAC keeps moving. The real protection is spanning tree with BPDU guard on edge ports, plus storm control.
Traps
- Treating the message as cosmetic. Constant flapping means frames are going the wrong way right now.
- Rebooting the switch to stop the messages. The cause is outside the switch.