{
  "id": "networking/mac-address-flapping-detected",
  "signature": "MAC address flapping detected: 00:1a:2b:3c:4d:5e between ports Gi0/1 and Gi0/2",
  "signature_zh": "检测到MAC地址漂移：00:1a:2b:3c:4d:5e在端口Gi0/1和Gi0/2之间",
  "regex": "MAC address flapping detected.*between ports",
  "domain": "networking",
  "category": "network_error",
  "subcategory": null,
  "root_cause": "The same MAC address is being learned on two different switch ports, typically due to a network loop, a misconfigured bridge, or a rogue device (e.g., a malicious DHCP server) causing the switch to constantly update its forwarding table.",
  "root_cause_type": "generic",
  "root_cause_zh": "同一个MAC地址在两个不同的交换机端口上被学习到，通常由网络环路、桥接配置错误或恶意设备（如伪造DHCP服务器）导致，使交换机不断更新其转发表。",
  "versions": [
    {
      "version": "Cisco IOS 15.2",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Juniper JunOS 22.1",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Linux bridge 5.10",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "This is a temporary fix; the flapping will recur immediately if the underlying loop or misconfiguration is not resolved.",
      "fail_rate": 0.95,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "This ignores the problem; the flapping can cause network instability, packet loss, and even broadcast storms if a loop exists.",
      "fail_rate": 0.8,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "This does not prevent the flapping; it only reduces the frequency of log messages, and can lead to stale entries.",
      "fail_rate": 0.7,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Enable Spanning Tree Protocol (STP) on the switch to detect and block loops: `spanning-tree vlan 1` (Cisco) or `set protocols rstp` (Juniper).",
      "success_rate": 0.9,
      "how": "Enable Spanning Tree Protocol (STP) on the switch to detect and block loops: `spanning-tree vlan 1` (Cisco) or `set protocols rstp` (Juniper).",
      "condition": "",
      "sources": []
    },
    {
      "action": "Identify the rogue device by checking the MAC address OUI and physically tracing the cable; then isolate the port with `shutdown` and reconfigure the network.",
      "success_rate": 0.85,
      "how": "Identify the rogue device by checking the MAC address OUI and physically tracing the cable; then isolate the port with `shutdown` and reconfigure the network.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Configure a static MAC address entry on the correct port to prevent flapping: `mac address-table static 00:1a:2b:3c:4d:5e vlan 1 interface Gi0/1`",
      "success_rate": 0.75,
      "how": "Configure a static MAC address entry on the correct port to prevent flapping: `mac address-table static 00:1a:2b:3c:4d:5e vlan 1 interface Gi0/1`",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "Enable Spanning Tree Protocol (STP) on the switch to detect and block loops: `spanning-tree vlan 1` (Cisco) or `set protocols rstp` (Juniper).",
    "Identify the rogue device by checking the MAC address OUI and physically tracing the cable; then isolate the port with `shutdown` and reconfigure the network.",
    "Configure a static MAC address entry on the correct port to prevent flapping: `mac address-table static 00:1a:2b:3c:4d:5e vlan 1 interface Gi0/1`"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_55_se/configuration/guide/scg3750/swmac.html",
  "official_doc_section": null,
  "error_code": null,
  "verification_tier": "ai_generated",
  "confidence": 0.88,
  "fix_success_rate": 0.85,
  "resolvable": "true",
  "first_seen": "2023-11-20",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}