Lessons · Network switches · a flapping address
One address in two places
A MAC flap is the switch learning the same address on one port, then on another, then back again. It means either a loop is carrying that device's frames round to a second port, or the device really is reachable two ways.
Hone is a place to practise programming. This is one of its lessons, written out in full and free to read without an account.
What it is for
It is the clearest fingerprint of a loop available, and it usually appears before anything is unusable. A flap noticed on Tuesday is a cable pulled on Tuesday; the same fault ignored is an unusable network on Wednesday morning.
How to think about it
The device whose address is moving is the witness, not the cause. Take the two ports and find out what is on each; the loop is nearly always between them. Nothing is wrong with the machine that owns the address.
Worked example
enableThe # prompt.
show mac address-tableThe Ports column is the whole question. One address should appear once.
show interfaces statusWhat is actually on each of the two ports it keeps moving between.
configure terminalSwitch(config)#.
interface gi0/6The one you suspect.
shutdownTake one of the two out of the picture. If the address stops moving, you have found the loop rather than guessed at it.
endSwitch#.
show mac address-tableAnd read it again. A table that has gone quiet is the answer.
Your turn
Take the suspect port out of service while you think.
Console into a switch
The trap
Blaming the device whose address is flapping and swapping its network card. Its frames are being carried somewhere they should not go; it is reporting the fault, not causing it.