What are MAC FLAPS?

Learn what MAC Flaps are and how to search logfiles on a switch to identify sources of them.

What are MAC FLAPS?

A MAC Flap is caused when a switch receives packets from two different interfaces with the same source MAC address.

If you are getting the behavior for a lot of other MACs, that most likely is a layer 2 loop.

Identify source of MAC Flaps via Logs on a switch

Logs on Cisco or Stratix Switch:

*Oct 20 11:48:26.254: %SW_MATM-4-MACFLAP_NOTIF: Host 0000.0000.0011 in vlan 1001 is flapping between port Gi0/23 and port Gi0/15
*Oct 20 11:48:41.286: %SW_MATM-4-MACFLAP_NOTIF: Host 0000.0000.0011 in vlan 1001 is flapping between port Gi0/23 and port Gi0/15
*Oct 20 11:48:56.286: %SW_MATM-4-MACFLAP_NOTIF: Host 0000.0000.0011 in vlan 1001 is flapping between port Gi0/15 and port Gi0/23
*Oct 20 11:49:11.286: %SW_MATM-4-MACFLAP_NOTIF: Host 0000.0000.0011 in vlan 1001 is flapping between port Gi0/15 and port Gi0/23
*Oct 20 11:49:26.318: %SW_MATM-4-MACFLAP_NOTIF: Host 0000.0000.0011 in vlan 1001 is flapping between port Gi0/23 and port Gi0/15

You can do the following:

• Check the network switches for misconfigurations that might cause a data-forwarding loop.
• If you are not running spanning-tree, turn it on.
• To track down a loop, start with the following command: #show mac-address-table address [flapping mac] 
• We see that the MAC is coming in on port gi0/15 and gi0/23. One port will lead us to where that MAC is plugged in and the other will lead us to the loop. Pick a port and start working through.
• Or Some load balancing techniques can send traffic to both ports, and that would cause the switch to go crazy, since it is receiving traffic from the same MAC on two or more different ports.
• Fix this type of LB make it active/standby or make sure the server uses 2 different mac addresses, one per NIC.