What is unknown unicast flooding, and what causes it in a network with no loops?
Show the answer
Say this first
A switch floods a unicast frame to the whole VLAN when it has no MAC entry for the destination. A little is normal. A lot usually means asymmetric routing where the MAC entry ages out (300 seconds) long before the router's ARP entry (4 hours), frequent topology changes flushing the table, a full MAC table, or hosts that receive but never send.
Go deeper
The classic case: asymmetric routing
DSW1 and DSW2 both have an SVI in VLAN 10. Traffic to server SRV1 leaves through DSW1, but SRV1 replies through its HSRP gateway on DSW2. DSW1 never sees a frame sourced by SRV1, so its MAC entry expires after 300 seconds. Its ARP entry is still valid for hours, so DSW1 keeps routing packets to SRV1's MAC, misses in the MAC table, and floods every one of them to all of VLAN 10.
Fixes, in order of preference:
- Make routing symmetric (align HSRP active with the routing path).
- Make MAC aging at least as long as the ARP timeout, or shorten ARP on the SVI below 300 seconds
(
arp timeout 240underinterface Vlan10).
Other causes
- Topology changes. 802.1D shortens aging to 15 seconds after a TCN; RSTP flushes at once. Access ports without PortFast create a topology change every time a PC boots.
- Full MAC table, from an attack or simply too many VMs for the platform.
- Silent receivers, such as a syslog collector that never transmits.
- Microsoft NLB in unicast mode, which floods by design.
How to spot it
Look for output traffic on access ports whose hosts are idle, or capture on a quiet port and look for unicast frames to other MACs.
They will ask next
Why is it also a security problem?
Every port in the VLAN gets a copy of the flooded flow, so any host can read traffic meant for someone else without doing anything active.
How do you keep unknown unicast off a specific port?
switchport block unicaston that interface. It suits ports where port security already pins the legitimate MACs, so nothing the host needs is lost.
Traps
- Blaming spanning tree for every flood. Check MAC and ARP timers and routing symmetry first.
- Raising MAC aging everywhere without thinking. Very long aging slows recovery when a host really moves.