Troubleshoot MAC Flaps and Layer 2 Loops on Catalyst Switches

A MAC flap is one of the clearest early warnings of a Layer 2 problem: the switch sees the same source MAC address arriving on different ports in rapid succession and keeps rewriting its MAC address table. Left alone, it degrades forwarding, spikes CPU, and often ends in a full broadcast storm. This guide follows Cisco's systematic approach to MAC flap troubleshooting — reading the log message, tracing the MAC through the topology, and applying the right protection features so the flap cannot recur.

What a MAC Flap Looks Like

On Cisco Catalyst switches, flapping is logged as:

%SW_MATM-4-MACFLAP_NOTIF: Host xxxx.xxxx.xxxx in vlan x is flapping
between port (1) and port (2)

The message names the MAC address and the two interfaces involved — one leads to the real device, the other leads toward the loop.

Root Causes

• Layer 2 loop — the most common cause, usually from STP misconfiguration or unmanaged switches.
• Faulty hardware or cabling — bad cables can deliver frames to the wrong interface.
• Duplicate MAC addresses — common in HA clusters with shared virtual MACs.
• MAC spoofing — a security issue that presents the same symptoms.

The Tracing Workflow

1. Note the MAC and interfaces from the log message.
2. Investigate the interfaces with show interfaces and show mac address-table to see which device is really there.
3. Trace the flapping MAC — run show mac address-table hop by hop on each L2 switch in the path; the port that does not lead to the device leads to the loop.
4. Check STP with show spanning-tree, and look for topology change notifications with show spanning-tree detail | include ieee|occur|from|is.
5. Confirm or rule out duplicate MACs on the network.

Protection Features That Stop Flaps

UDLD aggressive mode err-disables ports when a previously synchronized neighbor cannot be re-established — catching unidirectional links that STP cannot see. Storm control is implemented in hardware and suppresses broadcast, multicast and unknown-unicast floods on access ports without impacting performance. BPDU Guard on PortFast ports shuts down any port that receives BPDUs, stopping unauthorized devices from joining the STP domain.

Related: Cisco Catalyst STP 排障 covers the same loop symptoms from the STP angle, and Junos 接口 Flap 识别 explains interface flapping detection on Junos for a cross-vendor view.

原文链接：https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol-stp-8021d/221722-troubleshoot-mac-flaps-loop-on-cisco-cat.html