MAC Movement Detection

Once mac-movement detection is enabled and configured, MAC movement is monitored. If number of MAC moves in one second is more than the (user-defined) threshold limit, three values (old LIF, current LIF, number of MAC moves) are recorded.

This list of recorded values is parsed automatically; if a port is determined to have a high number LIFs that are experiencing MAC moves, then those LIFs are acted upon (RASlog is the default action, or shutdown).

For example, MAC A is moving between port 1, vlan 10 and port 2, vlan 10. MAC B is moving between port 1, vlan 20 and port 3, vlan 20. MAC C is moving between port 4, vlan 10 and port 5, vlan 10. All MACs have crossed the (user-defined) threshold. The list looks like this:

9036690-01 Rev AB