MAC address flap anomaly

[Azar]

I am having this alert in MS Switch at Dashboard. Can anyone do help to resolve this Alert.

[cmr]

What do the event logs say?  It should show what Mac address(es) are moving from port to port.

[Azar]

[cmr]

That is suggesting that the device is changing from being seen over the aggregate ports to the local port 3.  What is connected to Aggr/0 and port 3?

[Azar]

Around 7 Switches the Alert came like this.

[Mloraditch]

If you have non Meraki APs you can easily see this when clients roam. I think this is one of those alerts that someone at Meraki recently decided should become more visible, but there are definitely cases where this is spurious. As CMR said look at the ports in question if say port 3 is an AP and AGGR/0 is an uplink to another switch where more APs that's probably the cause.

[PhilipDAth]

This is my bet - WiFi clients roaming between APs.

[Brash]

^ 100%
Most of the time this is from devices roaming between different WAP's

[rhbirkelund]

That, or a server with virtual machines and misconfigured ports.

But my bet would also be wireless client roaming.

[annmarie24us]

My experiencing is the same devices roaming between different Access Points.

[Azar]

Hi All,

Thanks for your valuable time and sharing your experience

The client device is connected to wired network.

I have attached the event log snapshot here.

From where I have to start the troubleshooting

[cmr]

@Azar go and look at what is actually cabled to those three ports, is it a server, another switch, a wireless access point or... ?

[Azar]

How to prevent devices from MAC Address Flapping

[rhbirkelund]

Not really much you can do to prevent MAC Flapping from users, other than tell them to stand still and don't move a around, so they don't roam.

Instead of bridging the SSID directly to the VLAN, you could enable Layer 3 Roaming instead.