MAC Movement Overview

A MAC address is considered to have been moved when the same MAC address is received on a different interface in the same VLAN. In MCT, MAC movement is allowed on both local and remote nodes. However, a high MAC move rate can indicate the existence of a loop in the network, or an issue with the server-side interface, resulting in flapping. A high move rate requires the control plane to process an extremely high rate of MAC learn events and can potentially exhaust the control plane resources.

MAC Move Definitions

Rapid MAC Movement: A MAC that moves across multiple Logical Interfaces (LIF), ports, and VLANs is tracked for each second it moves. If the number of moves crosses the defined threshold, then it is treated as a MAC Move violation.
Slow MAC Movement: In the first second that MAC movement is detected, the movement is monitored. In that first second, if the number of moves does not cross the threshold, then the MAC will be tracked for a maximum of 10 seconds. If after 10 seconds the total number of moves is within the threshold, then no action is taken. If it exceeds the threshold limit, then an action will be triggered.