Once mac-movement detection is enabled and configured, MAC movement is monitored. If number of MAC moves in one second is more than the (user-defined) threshold limit, three values (old LIF, current LIF, number of MAC moves) are recorded.
This list of recorded values is parsed automatically; if a port is determined to have a high number LIFs that are experiencing MAC moves, then those LIFs are acted upon (RASlog is the default action, or shutdown).